grpc 1.63.0 → 1.69.0

data/third_party/boringssl-with-bazel/src/crypto/rand_extra/rand_extra.c

@@ -12,11 +12,21 @@
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
 
+#include <limits.h>
+
 #include <openssl/rand.h>
 
-#include <limits.h>
+#include "../bcm_support.h"
+#include "../fipsmodule/bcm_interface.h"
 
 
+int RAND_bytes(uint8_t *buf, size_t len) {
+  BCM_rand_bytes(buf, len);
+  return 1;
+}
+
+int RAND_pseudo_bytes(uint8_t *buf, size_t len) { return RAND_bytes(buf, len); }
+
 void RAND_seed(const void *buf, int num) {
   // OpenSSH calls |RAND_seed| before jailing on the assumption that any needed
   // file descriptors etc will be opened.
@@ -28,7 +38,7 @@ int RAND_load_file(const char *path, long num) {
   if (num < 0) {  // read the "whole file"
     return 1;
   } else if (num <= INT_MAX) {
-    return (int) num;
+    return (int)num;
   } else {
     return INT_MAX;
   }
@@ -38,37 +48,30 @@ const char *RAND_file_name(char *buf, size_t num) { return NULL; }
 
 void RAND_add(const void *buf, int num, double entropy) {}
 
-int RAND_egd(const char *path) {
-  return 255;
-}
+int RAND_egd(const char *path) { return 255; }
 
-int RAND_poll(void) {
-  return 1;
-}
+int RAND_poll(void) { return 1; }
 
-int RAND_status(void) {
-  return 1;
-}
+int RAND_status(void) { return 1; }
 
 static const struct rand_meth_st kSSLeayMethod = {
-  RAND_seed,
-  RAND_bytes,
-  RAND_cleanup,
-  RAND_add,
-  RAND_pseudo_bytes,
-  RAND_status,
+    RAND_seed, RAND_bytes,        RAND_cleanup,
+    RAND_add,  RAND_pseudo_bytes, RAND_status,
 };
 
-RAND_METHOD *RAND_SSLeay(void) {
-  return (RAND_METHOD*) &kSSLeayMethod;
-}
+RAND_METHOD *RAND_SSLeay(void) { return (RAND_METHOD *)&kSSLeayMethod; }
 
-RAND_METHOD *RAND_OpenSSL(void) {
-  return RAND_SSLeay();
-}
+RAND_METHOD *RAND_OpenSSL(void) { return RAND_SSLeay(); }
 
 const RAND_METHOD *RAND_get_rand_method(void) { return RAND_SSLeay(); }
 
 int RAND_set_rand_method(const RAND_METHOD *method) { return 1; }
 
 void RAND_cleanup(void) {}
+
+void RAND_get_system_entropy_for_custom_prng(uint8_t *buf, size_t len) {
+  if (len > 256) {
+    abort();
+  }
+  CRYPTO_sysrand_for_seed(buf, len);
+}

data/third_party/boringssl-with-bazel/src/crypto/rand_extra/sysrand_internal.h

@@ -0,0 +1,37 @@
+/* Copyright (c) 2024, Google Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
+
+#ifndef OPENSSL_HEADER_CRYPTO_SYSRAND_INTERNAL_H
+#define OPENSSL_HEADER_CRYPTO_SYSRAND_INTERNAL_H
+
+#include <openssl/base.h>
+
+#if defined(BORINGSSL_UNSAFE_DETERMINISTIC_MODE)
+#define OPENSSL_RAND_DETERMINISTIC
+#elif defined(OPENSSL_TRUSTY)
+#define OPENSSL_RAND_TRUSTY
+#elif defined(OPENSSL_WINDOWS)
+#define OPENSSL_RAND_WINDOWS
+#elif defined(OPENSSL_LINUX)
+#define OPENSSL_RAND_URANDOM
+#elif defined(OPENSSL_APPLE) && !defined(OPENSSL_MACOS)
+// Unlike macOS, iOS and similar hide away getentropy().
+#define OPENSSL_RAND_IOS
+#else
+// By default if you are integrating BoringSSL we expect you to
+// provide getentropy from the <unistd.h> header file.
+#define OPENSSL_RAND_GETENTROPY
+#endif
+
+#endif  // OPENSSL_HEADER_CRYPTO__SYSRAND_INTERNAL_H

data/third_party/boringssl-with-bazel/src/crypto/rand_extra/trusty.c

@@ -14,7 +14,8 @@
 
 #include <openssl/rand.h>
 
-#include "../fipsmodule/rand/internal.h"
+#include "../bcm_support.h"
+#include "sysrand_internal.h"
 
 #if defined(OPENSSL_RAND_TRUSTY)
 #include <stdint.h>
@@ -25,12 +26,19 @@
 
 #include <lib/rng/trusty_rng.h>
 
+void CRYPTO_init_sysrand(void) {}
+
 void CRYPTO_sysrand(uint8_t *out, size_t requested) {
   if (trusty_rng_hw_rand(out, requested) != NO_ERROR) {
     abort();
   }
 }
 
+int CRYPTO_sysrand_if_available(uint8_t *buf, size_t len) {
+  CRYPTO_sysrand(buf, len);
+  return 1;
+}
+
 void CRYPTO_sysrand_for_seed(uint8_t *out, size_t requested) {
   CRYPTO_sysrand(out, requested);
 }

data/third_party/boringssl-with-bazel/src/crypto/{fipsmodule/rand → rand_extra}/urandom.c

@@ -18,7 +18,8 @@
 
 #include <openssl/rand.h>
 
-#include "internal.h"
+#include "../bcm_support.h"
+#include "sysrand_internal.h"
 
 #if defined(OPENSSL_RAND_URANDOM)
 
@@ -62,8 +63,7 @@
 #include <openssl/mem.h>
 
 #include "getrandom_fillin.h"
-#include "../delocate.h"
-#include "../../internal.h"
+#include "../internal.h"
 
 
 #if defined(USE_NR_getrandom)
@@ -96,17 +96,17 @@ static ssize_t boringssl_getrandom(void *buf, size_t buf_len, unsigned flags) {
 static const int kHaveGetrandom = -3;
 
 // urandom_fd is a file descriptor to /dev/urandom. It's protected by |once|.
-DEFINE_BSS_GET(int, urandom_fd)
+static int urandom_fd;
 
 #if defined(USE_NR_getrandom)
 
 // getrandom_ready is one if |getrandom| had been initialized by the time
 // |init_once| was called and zero otherwise.
-DEFINE_BSS_GET(int, getrandom_ready)
+static int getrandom_ready;
 
 // extra_getrandom_flags_for_seed contains a value that is ORed into the flags
 // for getrandom() when reading entropy for a seed.
-DEFINE_BSS_GET(int, extra_getrandom_flags_for_seed)
+static int extra_getrandom_flags_for_seed;
 
 // On Android, check a system property to decide whether to set
 // |extra_getrandom_flags_for_seed| otherwise they will default to zero.  If
@@ -123,14 +123,14 @@ static void maybe_set_extra_getrandom_flags(void) {
 
   value[length] = 0;
   if (OPENSSL_strcasecmp(value, "true") == 0) {
-    *extra_getrandom_flags_for_seed_bss_get() = GRND_RANDOM;
+    extra_getrandom_flags_for_seed = GRND_RANDOM;
   }
 #endif
 }
 
 #endif  // USE_NR_getrandom
 
-DEFINE_STATIC_ONCE(rand_once)
+static CRYPTO_once_t rand_once = CRYPTO_ONCE_INIT;
 
 // init_once initializes the state of this module to values previously
 // requested. This is the only function that modifies |urandom_fd|, which may be
@@ -142,7 +142,7 @@ static void init_once(void) {
   ssize_t getrandom_ret =
       boringssl_getrandom(&dummy, sizeof(dummy), GRND_NONBLOCK);
   if (getrandom_ret == 1) {
-    *getrandom_ready_bss_get() = 1;
+    getrandom_ready = 1;
     have_getrandom = 1;
   } else if (getrandom_ret == -1 && errno == EAGAIN) {
     // We have getrandom, but the entropy pool has not been initialized yet.
@@ -157,7 +157,7 @@ static void init_once(void) {
   }
 
   if (have_getrandom) {
-    *urandom_fd_bss_get() = kHaveGetrandom;
+    urandom_fd = kHaveGetrandom;
     maybe_set_extra_getrandom_flags();
     return;
   }
@@ -185,19 +185,19 @@ static void init_once(void) {
     abort();
   }
 
-  *urandom_fd_bss_get() = fd;
+  urandom_fd = fd;
 }
 
-DEFINE_STATIC_ONCE(wait_for_entropy_once)
+static CRYPTO_once_t wait_for_entropy_once = CRYPTO_ONCE_INIT;
 
 static void wait_for_entropy(void) {
-  int fd = *urandom_fd_bss_get();
+  int fd = urandom_fd;
   if (fd == kHaveGetrandom) {
     // |getrandom| and |getentropy| support blocking in |fill_with_entropy|
     // directly. For |getrandom|, we first probe with a non-blocking call to aid
     // debugging.
 #if defined(USE_NR_getrandom)
-    if (*getrandom_ready_bss_get()) {
+    if (getrandom_ready) {
       // The entropy pool was already initialized in |init_once|.
       return;
     }
@@ -256,13 +256,13 @@ static int fill_with_entropy(uint8_t *out, size_t len, int block, int seed) {
 
 #if defined (USE_NR_getrandom)
   if (seed) {
-    getrandom_flags |= *extra_getrandom_flags_for_seed_bss_get();
+    getrandom_flags |= extra_getrandom_flags_for_seed;
   }
 #endif
 
   CRYPTO_init_sysrand();
   if (block) {
-    CRYPTO_once(wait_for_entropy_once_bss_get(), wait_for_entropy);
+    CRYPTO_once(&wait_for_entropy_once, wait_for_entropy);
   }
 
   // Clear |errno| so it has defined value if |read| or |getrandom|
@@ -271,7 +271,7 @@ static int fill_with_entropy(uint8_t *out, size_t len, int block, int seed) {
   while (len > 0) {
     ssize_t r;
 
-    if (*urandom_fd_bss_get() == kHaveGetrandom) {
+    if (urandom_fd == kHaveGetrandom) {
 #if defined(USE_NR_getrandom)
       r = boringssl_getrandom(out, len, getrandom_flags);
 #else  // USE_NR_getrandom
@@ -280,7 +280,7 @@ static int fill_with_entropy(uint8_t *out, size_t len, int block, int seed) {
 #endif
     } else {
       do {
-        r = read(*urandom_fd_bss_get(), out, len);
+        r = read(urandom_fd, out, len);
       } while (r == -1 && errno == EINTR);
     }
 
@@ -295,7 +295,7 @@ static int fill_with_entropy(uint8_t *out, size_t len, int block, int seed) {
 }
 
 void CRYPTO_init_sysrand(void) {
-  CRYPTO_once(rand_once_bss_get(), init_once);
+  CRYPTO_once(&rand_once, init_once);
 }
 
 // CRYPTO_sysrand puts |requested| random bytes into |out|.

data/third_party/boringssl-with-bazel/src/crypto/rand_extra/windows.c

@@ -14,7 +14,9 @@
 
 #include <openssl/rand.h>
 
-#include "../fipsmodule/rand/internal.h"
+#include "../bcm_support.h"
+#include "../internal.h"
+#include "sysrand_internal.h"
 
 #if defined(OPENSSL_RAND_WINDOWS)
 
@@ -88,6 +90,11 @@ void CRYPTO_sysrand(uint8_t *out, size_t requested) {
 
 #endif  // WINAPI_PARTITION_APP && !WINAPI_PARTITION_DESKTOP
 
+int CRYPTO_sysrand_if_available(uint8_t *buf, size_t len) {
+  CRYPTO_sysrand(buf, len);
+  return 1;
+}
+
 void CRYPTO_sysrand_for_seed(uint8_t *out, size_t requested) {
   CRYPTO_sysrand(out, requested);
 }

data/third_party/boringssl-with-bazel/src/crypto/rsa_extra/internal.h

@@ -58,6 +58,8 @@
 #ifndef OPENSSL_HEADER_RSA_EXTRA_INTERNAL_H
 #define OPENSSL_HEADER_RSA_EXTRA_INTERNAL_H
 
+#include <openssl/base.h>
+
 #if defined(__cplusplus)
 extern "C" {
 #endif

data/third_party/boringssl-with-bazel/src/crypto/spx/spx.c

@@ -16,24 +16,25 @@
 
 #include <string.h>
 
+#define OPENSSL_UNSTABLE_EXPERIMENTAL_SPX
+#include <openssl/experimental/spx.h>
 #include <openssl/rand.h>
 
 #include "./address.h"
 #include "./fors.h"
-#include "./internal.h"
 #include "./merkle.h"
 #include "./params.h"
 #include "./spx_util.h"
 #include "./thash.h"
 
-void spx_generate_key(uint8_t out_public_key[SPX_PUBLIC_KEY_BYTES],
+void SPX_generate_key(uint8_t out_public_key[SPX_PUBLIC_KEY_BYTES],
                       uint8_t out_secret_key[SPX_SECRET_KEY_BYTES]) {
   uint8_t seed[3 * SPX_N];
   RAND_bytes(seed, 3 * SPX_N);
-  spx_generate_key_from_seed(out_public_key, out_secret_key, seed);
+  SPX_generate_key_from_seed(out_public_key, out_secret_key, seed);
 }
 
-void spx_generate_key_from_seed(uint8_t out_public_key[SPX_PUBLIC_KEY_BYTES],
+void SPX_generate_key_from_seed(uint8_t out_public_key[SPX_PUBLIC_KEY_BYTES],
                                 uint8_t out_secret_key[SPX_SECRET_KEY_BYTES],
                                 const uint8_t seed[3 * SPX_N]) {
   // Initialize SK.seed || SK.prf || PK.seed from seed.
@@ -51,7 +52,7 @@ void spx_generate_key_from_seed(uint8_t out_public_key[SPX_PUBLIC_KEY_BYTES],
   memcpy(out_secret_key + 3 * SPX_N, out_public_key + SPX_N, SPX_N);
 }
 
-void spx_sign(uint8_t out_signature[SPX_SIGNATURE_BYTES],
+void SPX_sign(uint8_t out_signature[SPX_SIGNATURE_BYTES],
               const uint8_t secret_key[SPX_SECRET_KEY_BYTES],
               const uint8_t *msg, size_t msg_len, int randomized) {
   uint8_t addr[32] = {0};
@@ -102,7 +103,7 @@ void spx_sign(uint8_t out_signature[SPX_SIGNATURE_BYTES],
               idx_leaf, sk_seed, pk_seed);
 }
 
-int spx_verify(const uint8_t signature[SPX_SIGNATURE_BYTES],
+int SPX_verify(const uint8_t signature[SPX_SIGNATURE_BYTES],
                const uint8_t public_key[SPX_SECRET_KEY_BYTES],
                const uint8_t *msg, size_t msg_len) {
   uint8_t addr[32] = {0};

data/third_party/boringssl-with-bazel/src/crypto/x509/by_dir.c

@@ -56,8 +56,6 @@
 
 #include <inttypes.h>
 #include <string.h>
-#include <sys/stat.h>
-#include <sys/types.h>
 
 #include <openssl/buf.h>
 #include <openssl/err.h>
@@ -74,6 +72,7 @@ typedef struct lookup_dir_hashes_st {
 } BY_DIR_HASH;
 
 typedef struct lookup_dir_entry_st {
+  CRYPTO_MUTEX lock;
   char *dir;
   int dir_type;
   STACK_OF(BY_DIR_HASH) *hashes;
@@ -158,6 +157,7 @@ static int by_dir_hash_cmp(const BY_DIR_HASH *const *a,
 
 static void by_dir_entry_free(BY_DIR_ENTRY *ent) {
   if (ent != NULL) {
+    CRYPTO_MUTEX_cleanup(&ent->lock);
     OPENSSL_free(ent->dir);
     sk_BY_DIR_HASH_pop_free(ent->hashes, by_dir_hash_free);
     OPENSSL_free(ent);
@@ -172,6 +172,12 @@ static void free_dir(X509_LOOKUP *lu) {
   }
 }
 
+#if defined(OPENSSL_WINDOWS)
+#define DIR_HASH_SEPARATOR ';'
+#else
+#define DIR_HASH_SEPARATOR ':'
+#endif
+
 static int add_cert_dir(BY_DIR *ctx, const char *dir, int type) {
   size_t j, len;
   const char *s, *ss, *p;
@@ -184,7 +190,7 @@ static int add_cert_dir(BY_DIR *ctx, const char *dir, int type) {
   s = dir;
   p = s;
   do {
-    if ((*p == ':') || (*p == '\0')) {
+    if (*p == DIR_HASH_SEPARATOR || *p == '\0') {
       BY_DIR_ENTRY *ent;
       ss = s;
       s = p + 1;
@@ -211,15 +217,12 @@ static int add_cert_dir(BY_DIR *ctx, const char *dir, int type) {
       if (!ent) {
         return 0;
       }
+      CRYPTO_MUTEX_init(&ent->lock);
       ent->dir_type = type;
       ent->hashes = sk_BY_DIR_HASH_new(by_dir_hash_cmp);
-      ent->dir = OPENSSL_malloc(len + 1);
-      if (!ent->dir || !ent->hashes) {
-        by_dir_entry_free(ent);
-        return 0;
-      }
-      OPENSSL_strlcpy(ent->dir, ss, len + 1);
-      if (!sk_BY_DIR_ENTRY_push(ctx->dirs, ent)) {
+      ent->dir = OPENSSL_strndup(ss, len);
+      if (ent->dir == NULL || ent->hashes == NULL ||
+          !sk_BY_DIR_ENTRY_push(ctx->dirs, ent)) {
         by_dir_entry_free(ent);
         return 0;
       }
@@ -228,10 +231,6 @@ static int add_cert_dir(BY_DIR *ctx, const char *dir, int type) {
   return 1;
 }
 
-// g_ent_hashes_lock protects the |hashes| member of all |BY_DIR_ENTRY|
-// objects.
-static CRYPTO_MUTEX g_ent_hashes_lock = CRYPTO_MUTEX_INIT;
-
 static int get_cert_by_subject(X509_LOOKUP *xl, int type, X509_NAME *name,
                                X509_OBJECT *ret) {
   union {
@@ -296,7 +295,7 @@ static int get_cert_by_subject(X509_LOOKUP *xl, int type, X509_NAME *name,
       }
       if (type == X509_LU_CRL && ent->hashes) {
         htmp.hash = h;
-        CRYPTO_MUTEX_lock_read(&g_ent_hashes_lock);
+        CRYPTO_MUTEX_lock_read(&ent->lock);
         if (sk_BY_DIR_HASH_find(ent->hashes, &idx, &htmp)) {
           hent = sk_BY_DIR_HASH_value(ent->hashes, idx);
           k = hent->suffix;
@@ -304,7 +303,7 @@ static int get_cert_by_subject(X509_LOOKUP *xl, int type, X509_NAME *name,
           hent = NULL;
           k = 0;
         }
-        CRYPTO_MUTEX_unlock_read(&g_ent_hashes_lock);
+        CRYPTO_MUTEX_unlock_read(&ent->lock);
       } else {
         k = 0;
         hent = NULL;
@@ -312,28 +311,22 @@ static int get_cert_by_subject(X509_LOOKUP *xl, int type, X509_NAME *name,
       for (;;) {
         snprintf(b->data, b->max, "%s/%08" PRIx32 ".%s%d", ent->dir, h, postfix,
                  k);
-#ifndef OPENSSL_NO_POSIX_IO
-#if defined(_WIN32) && !defined(stat)
-#define stat _stat
-#endif
-        {
-          struct stat st;
-          if (stat(b->data, &st) < 0) {
-            break;
-          }
-        }
-#endif
-        // found one.
         if (type == X509_LU_X509) {
           if ((X509_load_cert_file(xl, b->data, ent->dir_type)) == 0) {
+            // Don't expose the lower level error, All of these boil
+            // down to "we could not find a CA".
+            ERR_clear_error();
             break;
           }
         } else if (type == X509_LU_CRL) {
           if ((X509_load_crl_file(xl, b->data, ent->dir_type)) == 0) {
+            // Don't expose the lower level error, All of these boil
+            // down to "we could not find a CRL".
+            ERR_clear_error();
             break;
           }
         }
-        // else case will caught higher up
+        // The lack of a CA or CRL will be caught higher up
         k++;
       }
 
@@ -349,7 +342,7 @@ static int get_cert_by_subject(X509_LOOKUP *xl, int type, X509_NAME *name,
       // If a CRL, update the last file suffix added for this
 
       if (type == X509_LU_CRL) {
-        CRYPTO_MUTEX_lock_write(&g_ent_hashes_lock);
+        CRYPTO_MUTEX_lock_write(&ent->lock);
         // Look for entry again in case another thread added an entry
         // first.
         if (!hent) {
@@ -362,14 +355,14 @@ static int get_cert_by_subject(X509_LOOKUP *xl, int type, X509_NAME *name,
         if (!hent) {
           hent = OPENSSL_malloc(sizeof(BY_DIR_HASH));
           if (hent == NULL) {
-            CRYPTO_MUTEX_unlock_write(&g_ent_hashes_lock);
+            CRYPTO_MUTEX_unlock_write(&ent->lock);
             ok = 0;
             goto finish;
           }
           hent->hash = h;
           hent->suffix = k;
           if (!sk_BY_DIR_HASH_push(ent->hashes, hent)) {
-            CRYPTO_MUTEX_unlock_write(&g_ent_hashes_lock);
+            CRYPTO_MUTEX_unlock_write(&ent->lock);
             OPENSSL_free(hent);
             ok = 0;
             goto finish;
@@ -379,7 +372,7 @@ static int get_cert_by_subject(X509_LOOKUP *xl, int type, X509_NAME *name,
           hent->suffix = k;
         }
 
-        CRYPTO_MUTEX_unlock_write(&g_ent_hashes_lock);
+        CRYPTO_MUTEX_unlock_write(&ent->lock);
       }
 
       if (tmp != NULL) {

data/third_party/boringssl-with-bazel/src/crypto/x509/by_file.c

@@ -228,7 +228,7 @@ int X509_load_cert_crl_file(X509_LOOKUP *ctx, const char *file, int type) {
   if (type != X509_FILETYPE_PEM) {
     return X509_load_cert_file(ctx, file, type);
   }
-  in = BIO_new_file(file, "r");
+  in = BIO_new_file(file, "rb");
   if (!in) {
     OPENSSL_PUT_ERROR(X509, ERR_R_SYS_LIB);
     return 0;

data/third_party/boringssl-with-bazel/src/crypto/x509/internal.h

@@ -341,8 +341,6 @@ struct x509_store_st {
 
   // Callbacks for various operations
   X509_STORE_CTX_verify_cb verify_cb;       // error callback
-  X509_STORE_CTX_get_crl_fn get_crl;        // retrieve CRL
-  X509_STORE_CTX_check_crl_fn check_crl;    // Check CRL validity
 
   CRYPTO_refcount_t references;
 } /* X509_STORE */;
@@ -374,8 +372,6 @@ struct x509_store_ctx_st {
 
   // Callbacks for various operations
   X509_STORE_CTX_verify_cb verify_cb;       // error callback
-  X509_STORE_CTX_get_crl_fn get_crl;        // retrieve CRL
-  X509_STORE_CTX_check_crl_fn check_crl;    // Check CRL validity
 
   // The following is built up
   int last_untrusted;     // index of last untrusted cert
@@ -422,7 +418,7 @@ int x509_print_rsa_pss_params(BIO *bp, const X509_ALGOR *sigalg, int indent,
 // Signature algorithm functions.
 
 // x509_digest_sign_algorithm encodes the signing parameters of |ctx| as an
-// AlgorithmIdentifer and saves the result in |algor|. It returns one on
+// AlgorithmIdentifier and saves the result in |algor|. It returns one on
 // success, or zero on error.
 int x509_digest_sign_algorithm(EVP_MD_CTX *ctx, X509_ALGOR *algor);
 
@@ -592,6 +588,9 @@ int X509_is_valid_trust_id(int trust);
 
 int X509_PURPOSE_get_trust(const X509_PURPOSE *xp);
 
+// TODO(https://crbug.com/boringssl/695): Remove this.
+int DIST_POINT_set_dpname(DIST_POINT_NAME *dpn, X509_NAME *iname);
+
 
 #if defined(__cplusplus)
 }  // extern C

data/third_party/boringssl-with-bazel/src/crypto/x509/rsa_pss.c

@@ -125,7 +125,11 @@ static int rsa_md_to_algor(X509_ALGOR **palg, const EVP_MD *md) {
   if (*palg == NULL) {
     return 0;
   }
-  X509_ALGOR_set_md(*palg, md);
+  if (!X509_ALGOR_set_md(*palg, md)) {
+    X509_ALGOR_free(*palg);
+    *palg = NULL;
+    return 0;
+  }
   return 1;
 }
 

data/third_party/boringssl-with-bazel/src/crypto/x509/v3_cpols.c

@@ -105,6 +105,11 @@ const X509V3_EXT_METHOD v3_cpols = {
     NULL,
 };
 
+DECLARE_ASN1_ITEM(POLICYINFO)
+DECLARE_ASN1_ITEM(POLICYQUALINFO)
+DECLARE_ASN1_ITEM(USERNOTICE)
+DECLARE_ASN1_ITEM(NOTICEREF)
+
 ASN1_ITEM_TEMPLATE(CERTIFICATEPOLICIES) = ASN1_EX_TEMPLATE_TYPE(
     ASN1_TFLG_SEQUENCE_OF, 0, CERTIFICATEPOLICIES, POLICYINFO)
 ASN1_ITEM_TEMPLATE_END(CERTIFICATEPOLICIES)
@@ -116,7 +121,7 @@ ASN1_SEQUENCE(POLICYINFO) = {
     ASN1_SEQUENCE_OF_OPT(POLICYINFO, qualifiers, POLICYQUALINFO),
 } ASN1_SEQUENCE_END(POLICYINFO)
 
-IMPLEMENT_ASN1_FUNCTIONS_const(POLICYINFO)
+IMPLEMENT_ASN1_ALLOC_FUNCTIONS(POLICYINFO)
 
 ASN1_ADB_TEMPLATE(policydefault) = ASN1_SIMPLE(POLICYQUALINFO, d.other,
                                                ASN1_ANY);
@@ -133,21 +138,21 @@ ASN1_SEQUENCE(POLICYQUALINFO) = {
     ASN1_ADB_OBJECT(POLICYQUALINFO),
 } ASN1_SEQUENCE_END(POLICYQUALINFO)
 
-IMPLEMENT_ASN1_FUNCTIONS_const(POLICYQUALINFO)
+IMPLEMENT_ASN1_ALLOC_FUNCTIONS(POLICYQUALINFO)
 
 ASN1_SEQUENCE(USERNOTICE) = {
     ASN1_OPT(USERNOTICE, noticeref, NOTICEREF),
     ASN1_OPT(USERNOTICE, exptext, DISPLAYTEXT),
 } ASN1_SEQUENCE_END(USERNOTICE)
 
-IMPLEMENT_ASN1_FUNCTIONS_const(USERNOTICE)
+IMPLEMENT_ASN1_ALLOC_FUNCTIONS(USERNOTICE)
 
 ASN1_SEQUENCE(NOTICEREF) = {
     ASN1_SIMPLE(NOTICEREF, organization, DISPLAYTEXT),
     ASN1_SEQUENCE_OF(NOTICEREF, noticenos, ASN1_INTEGER),
 } ASN1_SEQUENCE_END(NOTICEREF)
 
-IMPLEMENT_ASN1_FUNCTIONS_const(NOTICEREF)
+IMPLEMENT_ASN1_ALLOC_FUNCTIONS(NOTICEREF)
 
 static void *r2i_certpol(const X509V3_EXT_METHOD *method, const X509V3_CTX *ctx,
                          const char *value) {

data/third_party/boringssl-with-bazel/src/crypto/x509/v3_crld.c

@@ -393,7 +393,7 @@ ASN1_CHOICE_cb(DIST_POINT_NAME, dpn_cb) = {
     ASN1_IMP_SET_OF(DIST_POINT_NAME, name.relativename, X509_NAME_ENTRY, 1),
 } ASN1_CHOICE_END_cb(DIST_POINT_NAME, DIST_POINT_NAME, type)
 
-IMPLEMENT_ASN1_FUNCTIONS(DIST_POINT_NAME)
+IMPLEMENT_ASN1_ALLOC_FUNCTIONS(DIST_POINT_NAME)
 
 ASN1_SEQUENCE(DIST_POINT) = {
     ASN1_EXP_OPT(DIST_POINT, distpoint, DIST_POINT_NAME, 0),
@@ -401,7 +401,7 @@ ASN1_SEQUENCE(DIST_POINT) = {
     ASN1_IMP_SEQUENCE_OF_OPT(DIST_POINT, CRLissuer, GENERAL_NAME, 2),
 } ASN1_SEQUENCE_END(DIST_POINT)
 
-IMPLEMENT_ASN1_FUNCTIONS(DIST_POINT)
+IMPLEMENT_ASN1_ALLOC_FUNCTIONS(DIST_POINT)
 
 ASN1_ITEM_TEMPLATE(CRL_DIST_POINTS) = ASN1_EX_TEMPLATE_TYPE(
     ASN1_TFLG_SEQUENCE_OF, 0, CRLDistributionPoints, DIST_POINT)

data/third_party/boringssl-with-bazel/src/crypto/x509/v3_info.c

@@ -115,7 +115,7 @@ ASN1_SEQUENCE(ACCESS_DESCRIPTION) = {
     ASN1_SIMPLE(ACCESS_DESCRIPTION, location, GENERAL_NAME),
 } ASN1_SEQUENCE_END(ACCESS_DESCRIPTION)
 
-IMPLEMENT_ASN1_FUNCTIONS(ACCESS_DESCRIPTION)
+IMPLEMENT_ASN1_ALLOC_FUNCTIONS(ACCESS_DESCRIPTION)
 
 ASN1_ITEM_TEMPLATE(AUTHORITY_INFO_ACCESS) = ASN1_EX_TEMPLATE_TYPE(
     ASN1_TFLG_SEQUENCE_OF, 0, GeneralNames, ACCESS_DESCRIPTION)

data/third_party/boringssl-with-bazel/src/crypto/x509/v3_lib.c

@@ -70,6 +70,8 @@
 
 #include "ext_dat.h"
 
+DEFINE_STACK_OF(X509V3_EXT_METHOD)
+
 static STACK_OF(X509V3_EXT_METHOD) *ext_list = NULL;
 
 static int ext_stack_cmp(const X509V3_EXT_METHOD *const *a,