grpc 1.61.0 → 1.62.0

data/third_party/boringssl-with-bazel/src/crypto/asn1/a_mbstr.c

@@ -97,22 +97,22 @@ int ASN1_mbstring_ncopy(ASN1_STRING **out, const unsigned char *in,
   int error;
   switch (inform) {
     case MBSTRING_BMP:
-      decode_func = cbs_get_ucs2_be;
+      decode_func = CBS_get_ucs2_be;
       error = ASN1_R_INVALID_BMPSTRING;
       break;
 
     case MBSTRING_UNIV:
-      decode_func = cbs_get_utf32_be;
+      decode_func = CBS_get_utf32_be;
       error = ASN1_R_INVALID_UNIVERSALSTRING;
       break;
 
     case MBSTRING_UTF8:
-      decode_func = cbs_get_utf8;
+      decode_func = CBS_get_utf8;
       error = ASN1_R_INVALID_UTF8STRING;
       break;
 
     case MBSTRING_ASC:
-      decode_func = cbs_get_latin1;
+      decode_func = CBS_get_latin1;
       error = ERR_R_INTERNAL_ERROR;  // Latin-1 inputs are never invalid.
       break;
 
@@ -162,7 +162,7 @@ int ASN1_mbstring_ncopy(ASN1_STRING **out, const unsigned char *in,
     }
 
     nchar++;
-    utf8_len += cbb_get_utf8_len(c);
+    utf8_len += CBB_get_utf8_len(c);
     if (maxsize > 0 && nchar > (size_t)maxsize) {
       OPENSSL_PUT_ERROR(ASN1, ASN1_R_STRING_TOO_LONG);
       ERR_add_error_dataf("maxsize=%zu", (size_t)maxsize);
@@ -178,7 +178,7 @@ int ASN1_mbstring_ncopy(ASN1_STRING **out, const unsigned char *in,
 
   // Now work out output format and string type
   int str_type;
-  int (*encode_func)(CBB *, uint32_t) = cbb_add_latin1;
+  int (*encode_func)(CBB *, uint32_t) = CBB_add_latin1;
   size_t size_estimate = nchar;
   int outform = MBSTRING_ASC;
   if (mask & B_ASN1_PRINTABLESTRING) {
@@ -190,17 +190,17 @@ int ASN1_mbstring_ncopy(ASN1_STRING **out, const unsigned char *in,
   } else if (mask & B_ASN1_BMPSTRING) {
     str_type = V_ASN1_BMPSTRING;
     outform = MBSTRING_BMP;
-    encode_func = cbb_add_ucs2_be;
+    encode_func = CBB_add_ucs2_be;
     size_estimate = 2 * nchar;
   } else if (mask & B_ASN1_UNIVERSALSTRING) {
     str_type = V_ASN1_UNIVERSALSTRING;
-    encode_func = cbb_add_utf32_be;
+    encode_func = CBB_add_utf32_be;
     size_estimate = 4 * nchar;
     outform = MBSTRING_UNIV;
   } else if (mask & B_ASN1_UTF8STRING) {
     str_type = V_ASN1_UTF8STRING;
     outform = MBSTRING_UTF8;
-    encode_func = cbb_add_utf8;
+    encode_func = CBB_add_utf8;
     size_estimate = utf8_len;
   } else {
     OPENSSL_PUT_ERROR(ASN1, ASN1_R_ILLEGAL_CHARACTERS);

data/third_party/boringssl-with-bazel/src/crypto/asn1/a_strex.c

@@ -68,6 +68,7 @@
 #include <openssl/mem.h>
 
 #include "../bytestring/internal.h"
+#include "../internal.h"
 #include "internal.h"
 
 
@@ -137,19 +138,19 @@ static int do_buf(const unsigned char *buf, int buflen, int encoding,
   int get_char_error;
   switch (encoding) {
     case MBSTRING_UNIV:
-      get_char = cbs_get_utf32_be;
+      get_char = CBS_get_utf32_be;
       get_char_error = ASN1_R_INVALID_UNIVERSALSTRING;
       break;
     case MBSTRING_BMP:
-      get_char = cbs_get_ucs2_be;
+      get_char = CBS_get_ucs2_be;
       get_char_error = ASN1_R_INVALID_BMPSTRING;
       break;
     case MBSTRING_ASC:
-      get_char = cbs_get_latin1;
+      get_char = CBS_get_latin1;
       get_char_error = ERR_R_INTERNAL_ERROR;  // Should not be possible.
       break;
     case MBSTRING_UTF8:
-      get_char = cbs_get_utf8;
+      get_char = CBS_get_utf8;
       get_char_error = ASN1_R_INVALID_UTF8STRING;
       break;
     default:
@@ -172,7 +173,7 @@ static int do_buf(const unsigned char *buf, int buflen, int encoding,
       uint8_t utf8_buf[6];
       CBB utf8_cbb;
       CBB_init_fixed(&utf8_cbb, utf8_buf, sizeof(utf8_buf));
-      if (!cbb_add_utf8(&utf8_cbb, c)) {
+      if (!CBB_add_utf8(&utf8_cbb, c)) {
         OPENSSL_PUT_ERROR(ASN1, ERR_R_INTERNAL_ERROR);
         return 1;
       }
@@ -238,22 +239,8 @@ static int do_dump(unsigned long flags, BIO *out, const ASN1_STRING *str) {
   // Placing the ASN1_STRING in a temporary ASN1_TYPE allows the DER encoding
   // to readily obtained.
   ASN1_TYPE t;
-  t.type = str->type;
-  // Negative INTEGER and ENUMERATED values are the only case where
-  // |ASN1_STRING| and |ASN1_TYPE| types do not match.
-  //
-  // TODO(davidben): There are also some type fields which, in |ASN1_TYPE|, do
-  // not correspond to |ASN1_STRING|. It is unclear whether those are allowed
-  // in |ASN1_STRING| at all, or what the space of allowed types is.
-  // |ASN1_item_ex_d2i| will never produce such a value so, for now, we say
-  // this is an invalid input. But this corner of the library in general
-  // should be more robust.
-  if (t.type == V_ASN1_NEG_INTEGER) {
-    t.type = V_ASN1_INTEGER;
-  } else if (t.type == V_ASN1_NEG_ENUMERATED) {
-    t.type = V_ASN1_ENUMERATED;
-  }
-  t.value.asn1_string = (ASN1_STRING *)str;
+  OPENSSL_memset(&t, 0, sizeof(ASN1_TYPE));
+  asn1_type_set0_string(&t, (ASN1_STRING *)str);
   unsigned char *der_buf = NULL;
   int der_len = i2d_ASN1_TYPE(&t, &der_buf);
   if (der_len < 0) {

data/third_party/boringssl-with-bazel/src/crypto/asn1/a_time.c

@@ -55,7 +55,7 @@
  * [including the GNU Public Licence.] */
 
 #include <openssl/asn1.h>
-#include <openssl/time.h>
+#include <openssl/posix_time.h>
 
 #include <string.h>
 #include <time.h>

data/third_party/boringssl-with-bazel/src/crypto/asn1/a_type.c

@@ -56,7 +56,8 @@
 
 #include <openssl/asn1.h>
 
-#include <openssl/asn1t.h>
+#include <assert.h>
+
 #include <openssl/err.h>
 #include <openssl/mem.h>
 #include <openssl/obj.h>
@@ -89,6 +90,23 @@ const void *asn1_type_value_as_pointer(const ASN1_TYPE *a) {
   }
 }
 
+void asn1_type_set0_string(ASN1_TYPE *a, ASN1_STRING *str) {
+  // |ASN1_STRING| types are almost the same as |ASN1_TYPE| types, except that
+  // the negative flag is not reflected into |ASN1_TYPE|.
+  int type = str->type;
+  if (type == V_ASN1_NEG_INTEGER) {
+    type = V_ASN1_INTEGER;
+  } else if (type == V_ASN1_NEG_ENUMERATED) {
+    type = V_ASN1_ENUMERATED;
+  }
+
+  // These types are not |ASN1_STRING| types and use a different
+  // representation when stored in |ASN1_TYPE|.
+  assert(type != V_ASN1_NULL && type != V_ASN1_OBJECT &&
+         type != V_ASN1_BOOLEAN);
+  ASN1_TYPE_set(a, type, str);
+}
+
 void asn1_type_cleanup(ASN1_TYPE *a) {
   switch (a->type) {
     case V_ASN1_NULL:

data/third_party/boringssl-with-bazel/src/crypto/asn1/a_utctm.c

@@ -58,7 +58,7 @@
 #include <openssl/bytestring.h>
 #include <openssl/err.h>
 #include <openssl/mem.h>
-#include <openssl/time.h>
+#include <openssl/posix_time.h>
 
 #include <stdlib.h>
 #include <string.h>

data/third_party/boringssl-with-bazel/src/crypto/asn1/asn1_lib.c

@@ -102,6 +102,15 @@ OPENSSL_DECLARE_ERROR_REASON(ASN1, UNKNOWN_FORMAT)
 OPENSSL_DECLARE_ERROR_REASON(ASN1, UNKNOWN_TAG)
 OPENSSL_DECLARE_ERROR_REASON(ASN1, UNSUPPORTED_TYPE)
 
+// Limit |ASN1_STRING|s to 64 MiB of data. Most of this module, as well as
+// downstream code, does not correctly handle overflow. We cap string fields
+// more tightly than strictly necessary to fit in |int|. This is not expected to
+// impact real world uses of this field.
+//
+// In particular, this limit is small enough that the bit count of a BIT STRING
+// comfortably fits in an |int|, with room for arithmetic.
+#define ASN1_STRING_MAX (64 * 1024 * 1024)
+
 static void asn1_put_length(unsigned char **pp, int length);
 
 int ASN1_get_object(const unsigned char **inp, long *out_len, int *out_tag,
@@ -273,9 +282,8 @@ int ASN1_STRING_set(ASN1_STRING *str, const void *_data, ossl_ssize_t len_s) {
     len = (size_t)len_s;
   }
 
-  // |ASN1_STRING| cannot represent strings that exceed |int|, and we must
-  // reserve space for a trailing NUL below.
-  if (len > INT_MAX || len + 1 < len) {
+  static_assert(ASN1_STRING_MAX < INT_MAX, "len will not overflow int");
+  if (len > ASN1_STRING_MAX) {
     OPENSSL_PUT_ERROR(ASN1, ERR_R_OVERFLOW);
     return 0;
   }

data/third_party/boringssl-with-bazel/src/crypto/asn1/internal.h

@@ -210,6 +210,10 @@ void asn1_encoding_clear(ASN1_ENCODING *enc);
 // a pointer.
 const void *asn1_type_value_as_pointer(const ASN1_TYPE *a);
 
+// asn1_type_set0_string sets |a|'s value to the object represented by |str| and
+// takes ownership of |str|.
+void asn1_type_set0_string(ASN1_TYPE *a, ASN1_STRING *str);
+
 // asn1_type_cleanup releases memory associated with |a|'s value, without
 // freeing |a| itself.
 void asn1_type_cleanup(ASN1_TYPE *a);
@@ -256,7 +260,6 @@ typedef void ASN1_ex_free_func(ASN1_VALUE **pval, const ASN1_ITEM *it);
 typedef struct ASN1_EXTERN_FUNCS_st {
   ASN1_ex_new_func *asn1_ex_new;
   ASN1_ex_free_func *asn1_ex_free;
-  ASN1_ex_free_func *asn1_ex_clear;
   ASN1_ex_d2i *asn1_ex_d2i;
   ASN1_ex_i2d *asn1_ex_i2d;
 } ASN1_EXTERN_FUNCS;

data/third_party/boringssl-with-bazel/src/crypto/asn1/posix_time.c

@@ -15,7 +15,7 @@
 // Time conversion to/from POSIX time_t and struct tm, with no support
 // for time zones other than UTC
 
-#include <openssl/time.h>
+#include <openssl/posix_time.h>
 
 #include <assert.h>
 #include <inttypes.h>

data/third_party/boringssl-with-bazel/src/crypto/asn1/tasn_dec.c

@@ -850,7 +850,7 @@ static int asn1_ex_c2i(ASN1_VALUE **pval, const unsigned char *cont, long len,
       if (utype == V_ASN1_BMPSTRING) {
         while (CBS_len(&cbs) != 0) {
           uint32_t c;
-          if (!cbs_get_ucs2_be(&cbs, &c)) {
+          if (!CBS_get_ucs2_be(&cbs, &c)) {
             OPENSSL_PUT_ERROR(ASN1, ASN1_R_INVALID_BMPSTRING);
             goto err;
           }
@@ -859,7 +859,7 @@ static int asn1_ex_c2i(ASN1_VALUE **pval, const unsigned char *cont, long len,
       if (utype == V_ASN1_UNIVERSALSTRING) {
         while (CBS_len(&cbs) != 0) {
           uint32_t c;
-          if (!cbs_get_utf32_be(&cbs, &c)) {
+          if (!CBS_get_utf32_be(&cbs, &c)) {
             OPENSSL_PUT_ERROR(ASN1, ASN1_R_INVALID_UNIVERSALSTRING);
             goto err;
           }
@@ -868,7 +868,7 @@ static int asn1_ex_c2i(ASN1_VALUE **pval, const unsigned char *cont, long len,
       if (utype == V_ASN1_UTF8STRING) {
         while (CBS_len(&cbs) != 0) {
           uint32_t c;
-          if (!cbs_get_utf8(&cbs, &c)) {
+          if (!CBS_get_utf8(&cbs, &c)) {
             OPENSSL_PUT_ERROR(ASN1, ASN1_R_INVALID_UTF8STRING);
             goto err;
           }

data/third_party/boringssl-with-bazel/src/crypto/asn1/tasn_enc.c

@@ -452,14 +452,9 @@ static int asn1_set_seq_out(STACK_OF(ASN1_VALUE) *sk, unsigned char **out,
     return 1;
   }
 
-  if (sk_ASN1_VALUE_num(sk) > ((size_t)-1) / sizeof(DER_ENC)) {
-    OPENSSL_PUT_ERROR(ASN1, ERR_R_OVERFLOW);
-    return 0;
-  }
-
   int ret = 0;
   unsigned char *const buf = OPENSSL_malloc(skcontlen);
-  DER_ENC *encoded = OPENSSL_malloc(sk_ASN1_VALUE_num(sk) * sizeof(*encoded));
+  DER_ENC *encoded = OPENSSL_calloc(sk_ASN1_VALUE_num(sk), sizeof(*encoded));
   if (encoded == NULL || buf == NULL) {
     goto err;
   }

data/third_party/boringssl-with-bazel/src/crypto/asn1/tasn_new.c

@@ -127,11 +127,10 @@ int ASN1_item_ex_new(ASN1_VALUE **pval, const ASN1_ITEM *it) {
           return 1;
         }
       }
-      *pval = OPENSSL_malloc(it->size);
+      *pval = OPENSSL_zalloc(it->size);
       if (!*pval) {
         goto memerr;
       }
-      OPENSSL_memset(*pval, 0, it->size);
       asn1_set_choice_selector(pval, -1, it);
       if (asn1_cb && !asn1_cb(ASN1_OP_NEW_POST, pval, it, NULL)) {
         goto auxerr2;
@@ -151,11 +150,10 @@ int ASN1_item_ex_new(ASN1_VALUE **pval, const ASN1_ITEM *it) {
           return 1;
         }
       }
-      *pval = OPENSSL_malloc(it->size);
+      *pval = OPENSSL_zalloc(it->size);
       if (!*pval) {
         goto memerr;
       }
-      OPENSSL_memset(*pval, 0, it->size);
       asn1_refcount_set_one(pval, it);
       asn1_enc_init(pval, it);
       for (i = 0, tt = it->templates; i < it->tcount; tt++, i++) {
@@ -185,16 +183,9 @@ auxerr:
 }
 
 static void asn1_item_clear(ASN1_VALUE **pval, const ASN1_ITEM *it) {
-  const ASN1_EXTERN_FUNCS *ef;
-
   switch (it->itype) {
     case ASN1_ITYPE_EXTERN:
-      ef = it->funcs;
-      if (ef && ef->asn1_ex_clear) {
-        ef->asn1_ex_clear(pval, it);
-      } else {
-        *pval = NULL;
-      }
+      *pval = NULL;
       break;
 
     case ASN1_ITYPE_PRIMITIVE:
@@ -276,7 +267,7 @@ static int ASN1_primitive_new(ASN1_VALUE **pval, const ASN1_ITEM *it) {
   }
   switch (utype) {
     case V_ASN1_OBJECT:
-      *pval = (ASN1_VALUE *)OBJ_nid2obj(NID_undef);
+      *pval = (ASN1_VALUE *)OBJ_get_undef();
       return 1;
 
     case V_ASN1_BOOLEAN:

data/third_party/boringssl-with-bazel/src/crypto/base64/base64.c

@@ -121,12 +121,7 @@ int EVP_EncodedLength(size_t *out_len, size_t len) {
 }
 
 EVP_ENCODE_CTX *EVP_ENCODE_CTX_new(void) {
-  EVP_ENCODE_CTX *ret = OPENSSL_malloc(sizeof(EVP_ENCODE_CTX));
-  if (ret == NULL) {
-    return NULL;
-  }
-  OPENSSL_memset(ret, 0, sizeof(EVP_ENCODE_CTX));
-  return ret;
+  return OPENSSL_zalloc(sizeof(EVP_ENCODE_CTX));
 }
 
 void EVP_ENCODE_CTX_free(EVP_ENCODE_CTX *ctx) {

data/third_party/boringssl-with-bazel/src/crypto/bio/bio.c

@@ -69,16 +69,19 @@
 #include "../internal.h"
 
 
+static CRYPTO_EX_DATA_CLASS g_ex_data_class =
+    CRYPTO_EX_DATA_CLASS_INIT_WITH_APP_DATA;
+
 BIO *BIO_new(const BIO_METHOD *method) {
-  BIO *ret = OPENSSL_malloc(sizeof(BIO));
+  BIO *ret = OPENSSL_zalloc(sizeof(BIO));
   if (ret == NULL) {
     return NULL;
   }
 
-  OPENSSL_memset(ret, 0, sizeof(BIO));
   ret->method = method;
   ret->shutdown = 1;
   ret->references = 1;
+  CRYPTO_new_ex_data(&ret->ex_data);
 
   if (method->create != NULL && !method->create(ret)) {
     OPENSSL_free(ret);
@@ -102,6 +105,7 @@ int BIO_free(BIO *bio) {
       bio->method->destroy(bio);
     }
 
+    CRYPTO_free_ex_data(&g_ex_data_class, bio, &bio->ex_data);
     OPENSSL_free(bio);
   }
   return 1;
@@ -640,11 +644,10 @@ int BIO_get_new_index(void) {
 }
 
 BIO_METHOD *BIO_meth_new(int type, const char *name) {
-  BIO_METHOD *method = OPENSSL_malloc(sizeof(BIO_METHOD));
+  BIO_METHOD *method = OPENSSL_zalloc(sizeof(BIO_METHOD));
   if (method == NULL) {
     return NULL;
   }
-  OPENSSL_memset(method, 0, sizeof(BIO_METHOD));
   method->type = type;
   method->name = name;
   return method;
@@ -706,3 +709,23 @@ int BIO_meth_set_puts(BIO_METHOD *method, int (*puts)(BIO *, const char *)) {
   // Ignore the parameter. We implement |BIO_puts| using |BIO_write|.
   return 1;
 }
+
+int BIO_get_ex_new_index(long argl, void *argp,
+                                    CRYPTO_EX_unused *unused,
+                                    CRYPTO_EX_dup *dup_unused,
+                                    CRYPTO_EX_free *free_func) {
+  int index;
+  if (!CRYPTO_get_ex_new_index(&g_ex_data_class, &index, argl, argp,
+                               free_func)) {
+    return -1;
+  }
+  return index;
+}
+
+int BIO_set_ex_data(BIO *bio, int idx, void *data) {
+  return CRYPTO_set_ex_data(&bio->ex_data, idx, data);
+}
+
+void *BIO_get_ex_data(const BIO *bio, int idx) {
+  return CRYPTO_get_ex_data(&bio->ex_data, idx);
+}

data/third_party/boringssl-with-bazel/src/crypto/bio/connect.c

@@ -296,13 +296,10 @@ end:
 }
 
 static BIO_CONNECT *BIO_CONNECT_new(void) {
-  BIO_CONNECT *ret = OPENSSL_malloc(sizeof(BIO_CONNECT));
-
+  BIO_CONNECT *ret = OPENSSL_zalloc(sizeof(BIO_CONNECT));
   if (ret == NULL) {
     return NULL;
   }
-  OPENSSL_memset(ret, 0, sizeof(BIO_CONNECT));
-
   ret->state = BIO_CONN_S_BEFORE;
   return ret;
 }

data/third_party/boringssl-with-bazel/src/crypto/bio/pair.c

@@ -81,13 +81,10 @@ struct bio_bio_st {
 };
 
 static int bio_new(BIO *bio) {
-  struct bio_bio_st *b;
-
-  b = OPENSSL_malloc(sizeof *b);
+  struct bio_bio_st *b = OPENSSL_zalloc(sizeof *b);
   if (b == NULL) {
     return 0;
   }
-  OPENSSL_memset(b, 0, sizeof(struct bio_bio_st));
 
   b->size = 17 * 1024;  // enough for one TLS record (just a default)
   bio->ptr = b;

data/third_party/boringssl-with-bazel/src/crypto/bn_extra/convert.c

@@ -455,3 +455,11 @@ int BN_bn2binpad(const BIGNUM *in, uint8_t *out, int len) {
   }
   return len;
 }
+
+int BN_bn2lebinpad(const BIGNUM *in, uint8_t *out, int len) {
+  if (len < 0 ||
+      !BN_bn2le_padded(out, (size_t)len, in)) {
+    return -1;
+  }
+  return len;
+}

data/third_party/boringssl-with-bazel/src/crypto/buf/buf.c

@@ -64,17 +64,7 @@
 #include "../internal.h"
 
 
-BUF_MEM *BUF_MEM_new(void) {
-  BUF_MEM *ret;
-
-  ret = OPENSSL_malloc(sizeof(BUF_MEM));
-  if (ret == NULL) {
-    return NULL;
-  }
-
-  OPENSSL_memset(ret, 0, sizeof(BUF_MEM));
-  return ret;
-}
+BUF_MEM *BUF_MEM_new(void) { return OPENSSL_zalloc(sizeof(BUF_MEM)); }
 
 void BUF_MEM_free(BUF_MEM *buf) {
   if (buf == NULL) {

data/third_party/boringssl-with-bazel/src/crypto/bytestring/ber.c

@@ -18,13 +18,10 @@
 #include <string.h>
 
 #include "internal.h"
-#include "../internal.h"
 
 
-// kMaxDepth is a just a sanity limit. The code should be such that the length
-// of the input being processes always decreases. None the less, a very large
-// input could otherwise cause the stack to overflow.
-static const uint32_t kMaxDepth = 2048;
+// kMaxDepth limits the recursion depth to avoid overflowing the stack.
+static const uint32_t kMaxDepth = 128;
 
 // is_string_type returns one if |tag| is a string type and zero otherwise. It
 // ignores the constructed bit.
@@ -56,13 +53,11 @@ static int is_string_type(CBS_ASN1_TAG tag) {
 // found. The value of |orig_in| is not changed. It returns one on success (i.e.
 // |*ber_found| was set) and zero on error.
 static int cbs_find_ber(const CBS *orig_in, int *ber_found, uint32_t depth) {
-  CBS in;
-
   if (depth > kMaxDepth) {
     return 0;
   }
 
-  CBS_init(&in, CBS_data(orig_in), CBS_len(orig_in));
+  CBS in = *orig_in;
   *ber_found = 0;
 
   while (CBS_len(&in) > 0) {
@@ -87,6 +82,10 @@ static int cbs_find_ber(const CBS *orig_in, int *ber_found, uint32_t depth) {
           !cbs_find_ber(&contents, ber_found, depth + 1)) {
         return 0;
       }
+      if (*ber_found) {
+        // We already found BER. No need to continue parsing.
+        return 1;
+      }
     }
   }
 

data/third_party/boringssl-with-bazel/src/crypto/bytestring/cbb.c

@@ -155,6 +155,29 @@ static struct cbb_buffer_st *cbb_get_base(CBB *cbb) {
   return &cbb->u.base;
 }
 
+static void cbb_on_error(CBB *cbb) {
+  // Due to C's lack of destructors and |CBB|'s auto-flushing API, a failing
+  // |CBB|-taking function may leave a dangling pointer to a child |CBB|. As a
+  // result, the convention is callers may not write to |CBB|s that have failed.
+  // But, as a safety measure, we lock the |CBB| into an error state. Once the
+  // error bit is set, |cbb->child| will not be read.
+  //
+  // TODO(davidben): This still isn't quite ideal. A |CBB| function *outside*
+  // this file may originate an error while the |CBB| points to a local child.
+  // In that case we don't set the error bit and are reliant on the error
+  // convention. Perhaps we allow |CBB_cleanup| on child |CBB|s and make every
+  // child's |CBB_cleanup| set the error bit if unflushed. That will be
+  // convenient for C++ callers, but very tedious for C callers. So C callers
+  // perhaps should get a |CBB_on_error| function that can be, less tediously,
+  // stuck in a |goto err| block.
+  cbb_get_base(cbb)->error = 1;
+
+  // Clearing the pointer is not strictly necessary, but GCC's dangling pointer
+  // warning does not know |cbb->child| will not be read once |error| is set
+  // above.
+  cbb->child = NULL;
+}
+
 // CBB_flush recurses and then writes out any pending length prefix. The
 // current length of the underlying base is taken to be the length of the
 // length-prefixed data.
@@ -244,7 +267,7 @@ int CBB_flush(CBB *cbb) {
   return 1;
 
 err:
-  base->error = 1;
+  cbb_on_error(cbb);
   return 0;
 }
 
@@ -420,7 +443,7 @@ static int cbb_add_u(CBB *cbb, uint64_t v, size_t len_len) {
 
   // |v| must fit in |len_len| bytes.
   if (v != 0) {
-    cbb_get_base(cbb)->error = 1;
+    cbb_on_error(cbb);
     return 0;
   }
 
@@ -479,7 +502,7 @@ int CBB_add_asn1_uint64(CBB *cbb, uint64_t value) {
 int CBB_add_asn1_uint64_with_tag(CBB *cbb, uint64_t value, CBS_ASN1_TAG tag) {
   CBB child;
   if (!CBB_add_asn1(cbb, &child, tag)) {
-    return 0;
+    goto err;
   }
 
   int started = 0;
@@ -493,21 +516,25 @@ int CBB_add_asn1_uint64_with_tag(CBB *cbb, uint64_t value, CBS_ASN1_TAG tag) {
       // If the high bit is set, add a padding byte to make it
       // unsigned.
       if ((byte & 0x80) && !CBB_add_u8(&child, 0)) {
-        return 0;
+        goto err;
       }
       started = 1;
     }
     if (!CBB_add_u8(&child, byte)) {
-      return 0;
+      goto err;
     }
   }
 
   // 0 is encoded as a single 0, not the empty string.
   if (!started && !CBB_add_u8(&child, 0)) {
-    return 0;
+    goto err;
   }
 
   return CBB_flush(cbb);
+
+err:
+  cbb_on_error(cbb);
+  return 0;
 }
 
 int CBB_add_asn1_int64(CBB *cbb, int64_t value) {
@@ -529,14 +556,18 @@ int CBB_add_asn1_int64_with_tag(CBB *cbb, int64_t value, CBS_ASN1_TAG tag) {
 
   CBB child;
   if (!CBB_add_asn1(cbb, &child, tag)) {
-    return 0;
+    goto err;
   }
   for (int i = start; i >= 0; i--) {
     if (!CBB_add_u8(&child, bytes[i])) {
-      return 0;
+      goto err;
     }
   }
   return CBB_flush(cbb);
+
+err:
+  cbb_on_error(cbb);
+  return 0;
 }
 
 int CBB_add_asn1_octet_string(CBB *cbb, const uint8_t *data, size_t data_len) {
@@ -544,6 +575,7 @@ int CBB_add_asn1_octet_string(CBB *cbb, const uint8_t *data, size_t data_len) {
   if (!CBB_add_asn1(cbb, &child, CBS_ASN1_OCTETSTRING) ||
       !CBB_add_bytes(&child, data, data_len) ||
       !CBB_flush(cbb)) {
+    cbb_on_error(cbb);
     return 0;
   }
 
@@ -555,6 +587,7 @@ int CBB_add_asn1_bool(CBB *cbb, int value) {
   if (!CBB_add_asn1(cbb, &child, CBS_ASN1_BOOLEAN) ||
       !CBB_add_u8(&child, value != 0 ? 0xff : 0) ||
       !CBB_flush(cbb)) {
+    cbb_on_error(cbb);
     return 0;
   }
 
@@ -649,16 +682,13 @@ int CBB_flush_asn1_set_of(CBB *cbb) {
   if (num_children < 2) {
     return 1;  // Nothing to do. This is the common case for X.509.
   }
-  if (num_children > ((size_t)-1) / sizeof(CBS)) {
-    return 0;  // Overflow.
-  }
 
   // Parse out the children and sort. We alias them into a copy of so they
   // remain valid as we rewrite |cbb|.
   int ret = 0;
   size_t buf_len = CBB_len(cbb);
   uint8_t *buf = OPENSSL_memdup(CBB_data(cbb), buf_len);
-  CBS *children = OPENSSL_malloc(num_children * sizeof(CBS));
+  CBS *children = OPENSSL_calloc(num_children, sizeof(CBS));
   if (buf == NULL || children == NULL) {
     goto err;
   }