grpc 1.69.0 → 1.70.1

data/third_party/boringssl-with-bazel/src/crypto/x509/{x509_vfy.c → x509_vfy.cc}

@@ -180,261 +180,265 @@ int X509_verify_cert(X509_STORE_CTX *ctx) {
   int j, retry, trust;
   STACK_OF(X509) *sktmp = NULL;
 
-  if (ctx->cert == NULL) {
-    OPENSSL_PUT_ERROR(X509, X509_R_NO_CERT_SET_FOR_US_TO_VERIFY);
-    ctx->error = X509_V_ERR_INVALID_CALL;
-    return 0;
-  }
-
-  if (ctx->chain != NULL) {
-    // This X509_STORE_CTX has already been used to verify a cert. We
-    // cannot do another one.
-    OPENSSL_PUT_ERROR(X509, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
-    ctx->error = X509_V_ERR_INVALID_CALL;
-    return 0;
-  }
-
-  if (ctx->param->flags &
-      (X509_V_FLAG_EXTENDED_CRL_SUPPORT | X509_V_FLAG_USE_DELTAS)) {
-    // We do not support indirect or delta CRLs. The flags still exist for
-    // compatibility with bindings libraries, but to ensure we do not
-    // inadvertently skip a CRL check that the caller expects, fail closed.
-    OPENSSL_PUT_ERROR(X509, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
-    ctx->error = X509_V_ERR_INVALID_CALL;
-    return 0;
-  }
-
-  // first we make sure the chain we are going to build is present and that
-  // the first entry is in place
-  ctx->chain = sk_X509_new_null();
-  if (ctx->chain == NULL || !sk_X509_push(ctx->chain, ctx->cert)) {
-    ctx->error = X509_V_ERR_OUT_OF_MEM;
-    goto end;
-  }
-  X509_up_ref(ctx->cert);
-  ctx->last_untrusted = 1;
-
-  // We use a temporary STACK so we can chop and hack at it.
-  if (ctx->untrusted != NULL && (sktmp = sk_X509_dup(ctx->untrusted)) == NULL) {
-    ctx->error = X509_V_ERR_OUT_OF_MEM;
-    goto end;
-  }
-
-  int num = (int)sk_X509_num(ctx->chain);
-  X509 *x = sk_X509_value(ctx->chain, num - 1);
-  // |param->depth| does not include the leaf certificate or the trust anchor,
-  // so the maximum size is 2 more.
-  int max_chain = param->depth >= INT_MAX - 2 ? INT_MAX : param->depth + 2;
-
-  for (;;) {
-    if (num >= max_chain) {
-      // FIXME: If this happens, we should take note of it and, if appropriate,
-      // use the X509_V_ERR_CERT_CHAIN_TOO_LONG error code later.
-      break;
+  {
+    if (ctx->cert == NULL) {
+      OPENSSL_PUT_ERROR(X509, X509_R_NO_CERT_SET_FOR_US_TO_VERIFY);
+      ctx->error = X509_V_ERR_INVALID_CALL;
+      return 0;
     }
 
-    int is_self_signed;
-    if (!cert_self_signed(x, &is_self_signed)) {
-      ctx->error = X509_V_ERR_INVALID_EXTENSION;
-      goto end;
+    if (ctx->chain != NULL) {
+      // This X509_STORE_CTX has already been used to verify a cert. We
+      // cannot do another one.
+      OPENSSL_PUT_ERROR(X509, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+      ctx->error = X509_V_ERR_INVALID_CALL;
+      return 0;
     }
 
-    // If we are self signed, we break
-    if (is_self_signed) {
-      break;
-    }
-    // If asked see if we can find issuer in trusted store first
-    if (ctx->param->flags & X509_V_FLAG_TRUSTED_FIRST) {
-      X509 *issuer = get_trusted_issuer(ctx, x);
-      if (issuer != NULL) {
-        // Free the certificate. It will be picked up again later.
-        X509_free(issuer);
-        break;
-      }
+    if (ctx->param->flags &
+        (X509_V_FLAG_EXTENDED_CRL_SUPPORT | X509_V_FLAG_USE_DELTAS)) {
+      // We do not support indirect or delta CRLs. The flags still exist for
+      // compatibility with bindings libraries, but to ensure we do not
+      // inadvertently skip a CRL check that the caller expects, fail closed.
+      OPENSSL_PUT_ERROR(X509, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+      ctx->error = X509_V_ERR_INVALID_CALL;
+      return 0;
     }
 
-    // If we were passed a cert chain, use it first
-    if (sktmp != NULL) {
-      X509 *issuer = find_issuer(ctx, sktmp, x);
-      if (issuer != NULL) {
-        if (!sk_X509_push(ctx->chain, issuer)) {
-          ctx->error = X509_V_ERR_OUT_OF_MEM;
-          goto end;
-        }
-        X509_up_ref(issuer);
-        (void)sk_X509_delete_ptr(sktmp, issuer);
-        ctx->last_untrusted++;
-        x = issuer;
-        num++;
-        // reparse the full chain for the next one
-        continue;
-      }
+    // first we make sure the chain we are going to build is present and that
+    // the first entry is in place
+    ctx->chain = sk_X509_new_null();
+    if (ctx->chain == NULL || !sk_X509_push(ctx->chain, ctx->cert)) {
+      ctx->error = X509_V_ERR_OUT_OF_MEM;
+      goto end;
     }
-    break;
-  }
+    X509_up_ref(ctx->cert);
+    ctx->last_untrusted = 1;
 
-  // Remember how many untrusted certs we have
-  j = num;
-  // at this point, chain should contain a list of untrusted certificates.
-  // We now need to add at least one trusted one, if possible, otherwise we
-  // complain.
-
-  do {
-    // Examine last certificate in chain and see if it is self signed.
-    i = (int)sk_X509_num(ctx->chain);
-    x = sk_X509_value(ctx->chain, i - 1);
-
-    int is_self_signed;
-    if (!cert_self_signed(x, &is_self_signed)) {
-      ctx->error = X509_V_ERR_INVALID_EXTENSION;
+    // We use a temporary STACK so we can chop and hack at it.
+    if (ctx->untrusted != NULL &&
+        (sktmp = sk_X509_dup(ctx->untrusted)) == NULL) {
+      ctx->error = X509_V_ERR_OUT_OF_MEM;
       goto end;
     }
 
-    if (is_self_signed) {
-      // we have a self signed certificate
-      if (sk_X509_num(ctx->chain) == 1) {
-        // We have a single self signed certificate: see if we can
-        // find it in the store. We must have an exact match to avoid
-        // possible impersonation.
-        X509 *issuer = get_trusted_issuer(ctx, x);
-        if (issuer == NULL || X509_cmp(x, issuer) != 0) {
-          X509_free(issuer);
-          ctx->error = X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT;
-          ctx->current_cert = x;
-          ctx->error_depth = i - 1;
-          bad_chain = 1;
-          if (!call_verify_cb(0, ctx)) {
-            goto end;
-          }
-        } else {
-          // We have a match: replace certificate with store
-          // version so we get any trust settings.
-          X509_free(x);
-          x = issuer;
-          (void)sk_X509_set(ctx->chain, i - 1, x);
-          ctx->last_untrusted = 0;
-        }
-      } else {
-        // extract and save self signed certificate for later use
-        chain_ss = sk_X509_pop(ctx->chain);
-        ctx->last_untrusted--;
-        num--;
-        j--;
-        x = sk_X509_value(ctx->chain, num - 1);
-      }
-    }
-    // We now lookup certs from the certificate store
+    int num = (int)sk_X509_num(ctx->chain);
+    X509 *x = sk_X509_value(ctx->chain, num - 1);
+    // |param->depth| does not include the leaf certificate or the trust anchor,
+    // so the maximum size is 2 more.
+    int max_chain = param->depth >= INT_MAX - 2 ? INT_MAX : param->depth + 2;
+
     for (;;) {
       if (num >= max_chain) {
         // FIXME: If this happens, we should take note of it and, if
         // appropriate, use the X509_V_ERR_CERT_CHAIN_TOO_LONG error code later.
         break;
       }
+
+      int is_self_signed;
       if (!cert_self_signed(x, &is_self_signed)) {
         ctx->error = X509_V_ERR_INVALID_EXTENSION;
         goto end;
       }
+
       // If we are self signed, we break
       if (is_self_signed) {
         break;
       }
-      X509 *issuer = get_trusted_issuer(ctx, x);
-      if (issuer == NULL) {
-        break;
+      // If asked see if we can find issuer in trusted store first
+      if (ctx->param->flags & X509_V_FLAG_TRUSTED_FIRST) {
+        X509 *issuer = get_trusted_issuer(ctx, x);
+        if (issuer != NULL) {
+          // Free the certificate. It will be picked up again later.
+          X509_free(issuer);
+          break;
+        }
       }
-      x = issuer;
-      if (!sk_X509_push(ctx->chain, x)) {
-        X509_free(issuer);
-        ctx->error = X509_V_ERR_OUT_OF_MEM;
-        goto end;
+
+      // If we were passed a cert chain, use it first
+      if (sktmp != NULL) {
+        X509 *issuer = find_issuer(ctx, sktmp, x);
+        if (issuer != NULL) {
+          if (!sk_X509_push(ctx->chain, issuer)) {
+            ctx->error = X509_V_ERR_OUT_OF_MEM;
+            goto end;
+          }
+          X509_up_ref(issuer);
+          (void)sk_X509_delete_ptr(sktmp, issuer);
+          ctx->last_untrusted++;
+          x = issuer;
+          num++;
+          // reparse the full chain for the next one
+          continue;
+        }
       }
-      num++;
+      break;
     }
 
-    // we now have our chain, lets check it...
-    trust = check_trust(ctx);
+    // Remember how many untrusted certs we have
+    j = num;
+    // at this point, chain should contain a list of untrusted certificates.
+    // We now need to add at least one trusted one, if possible, otherwise we
+    // complain.
 
-    // If explicitly rejected error
-    if (trust == X509_TRUST_REJECTED) {
-      goto end;
-    }
-    // If it's not explicitly trusted then check if there is an alternative
-    // chain that could be used. We only do this if we haven't already
-    // checked via TRUSTED_FIRST and the user hasn't switched off alternate
-    // chain checking
-    retry = 0;
-    if (trust != X509_TRUST_TRUSTED &&
-        !(ctx->param->flags & X509_V_FLAG_TRUSTED_FIRST) &&
-        !(ctx->param->flags & X509_V_FLAG_NO_ALT_CHAINS)) {
-      while (j-- > 1) {
-        X509 *issuer =
-            get_trusted_issuer(ctx, sk_X509_value(ctx->chain, j - 1));
-        // Check if we found an alternate chain
-        if (issuer != NULL) {
-          // Free up the found cert we'll add it again later
-          X509_free(issuer);
+    do {
+      // Examine last certificate in chain and see if it is self signed.
+      i = (int)sk_X509_num(ctx->chain);
+      x = sk_X509_value(ctx->chain, i - 1);
+
+      int is_self_signed;
+      if (!cert_self_signed(x, &is_self_signed)) {
+        ctx->error = X509_V_ERR_INVALID_EXTENSION;
+        goto end;
+      }
 
-          // Dump all the certs above this point - we've found an
-          // alternate chain
-          while (num > j) {
-            X509_free(sk_X509_pop(ctx->chain));
-            num--;
+      if (is_self_signed) {
+        // we have a self signed certificate
+        if (sk_X509_num(ctx->chain) == 1) {
+          // We have a single self signed certificate: see if we can
+          // find it in the store. We must have an exact match to avoid
+          // possible impersonation.
+          X509 *issuer = get_trusted_issuer(ctx, x);
+          if (issuer == NULL || X509_cmp(x, issuer) != 0) {
+            X509_free(issuer);
+            ctx->error = X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT;
+            ctx->current_cert = x;
+            ctx->error_depth = i - 1;
+            bad_chain = 1;
+            if (!call_verify_cb(0, ctx)) {
+              goto end;
+            }
+          } else {
+            // We have a match: replace certificate with store
+            // version so we get any trust settings.
+            X509_free(x);
+            x = issuer;
+            (void)sk_X509_set(ctx->chain, i - 1, x);
+            ctx->last_untrusted = 0;
           }
-          ctx->last_untrusted = (int)sk_X509_num(ctx->chain);
-          retry = 1;
+        } else {
+          // extract and save self signed certificate for later use
+          chain_ss = sk_X509_pop(ctx->chain);
+          ctx->last_untrusted--;
+          num--;
+          j--;
+          x = sk_X509_value(ctx->chain, num - 1);
+        }
+      }
+      // We now lookup certs from the certificate store
+      for (;;) {
+        if (num >= max_chain) {
+          // FIXME: If this happens, we should take note of it and, if
+          // appropriate, use the X509_V_ERR_CERT_CHAIN_TOO_LONG error code
+          // later.
           break;
         }
+        if (!cert_self_signed(x, &is_self_signed)) {
+          ctx->error = X509_V_ERR_INVALID_EXTENSION;
+          goto end;
+        }
+        // If we are self signed, we break
+        if (is_self_signed) {
+          break;
+        }
+        X509 *issuer = get_trusted_issuer(ctx, x);
+        if (issuer == NULL) {
+          break;
+        }
+        x = issuer;
+        if (!sk_X509_push(ctx->chain, x)) {
+          X509_free(issuer);
+          ctx->error = X509_V_ERR_OUT_OF_MEM;
+          goto end;
+        }
+        num++;
       }
-    }
-  } while (retry);
 
-  // If not explicitly trusted then indicate error unless it's a single
-  // self signed certificate in which case we've indicated an error already
-  // and set bad_chain == 1
-  if (trust != X509_TRUST_TRUSTED && !bad_chain) {
-    if (chain_ss == NULL ||
-        !x509_check_issued_with_callback(ctx, x, chain_ss)) {
-      if (ctx->last_untrusted >= num) {
-        ctx->error = X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY;
+      // we now have our chain, lets check it...
+      trust = check_trust(ctx);
+
+      // If explicitly rejected error
+      if (trust == X509_TRUST_REJECTED) {
+        goto end;
+      }
+      // If it's not explicitly trusted then check if there is an alternative
+      // chain that could be used. We only do this if we haven't already
+      // checked via TRUSTED_FIRST and the user hasn't switched off alternate
+      // chain checking
+      retry = 0;
+      if (trust != X509_TRUST_TRUSTED &&
+          !(ctx->param->flags & X509_V_FLAG_TRUSTED_FIRST) &&
+          !(ctx->param->flags & X509_V_FLAG_NO_ALT_CHAINS)) {
+        while (j-- > 1) {
+          X509 *issuer =
+              get_trusted_issuer(ctx, sk_X509_value(ctx->chain, j - 1));
+          // Check if we found an alternate chain
+          if (issuer != NULL) {
+            // Free up the found cert we'll add it again later
+            X509_free(issuer);
+
+            // Dump all the certs above this point - we've found an
+            // alternate chain
+            while (num > j) {
+              X509_free(sk_X509_pop(ctx->chain));
+              num--;
+            }
+            ctx->last_untrusted = (int)sk_X509_num(ctx->chain);
+            retry = 1;
+            break;
+          }
+        }
+      }
+    } while (retry);
+
+    // If not explicitly trusted then indicate error unless it's a single
+    // self signed certificate in which case we've indicated an error already
+    // and set bad_chain == 1
+    if (trust != X509_TRUST_TRUSTED && !bad_chain) {
+      if (chain_ss == NULL ||
+          !x509_check_issued_with_callback(ctx, x, chain_ss)) {
+        if (ctx->last_untrusted >= num) {
+          ctx->error = X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY;
+        } else {
+          ctx->error = X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT;
+        }
+        ctx->current_cert = x;
       } else {
-        ctx->error = X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT;
+        if (!sk_X509_push(ctx->chain, chain_ss)) {
+          ctx->error = X509_V_ERR_OUT_OF_MEM;
+          goto end;
+        }
+        num++;
+        ctx->last_untrusted = num;
+        ctx->current_cert = chain_ss;
+        ctx->error = X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN;
+        chain_ss = NULL;
       }
-      ctx->current_cert = x;
-    } else {
-      if (!sk_X509_push(ctx->chain, chain_ss)) {
-        ctx->error = X509_V_ERR_OUT_OF_MEM;
+
+      ctx->error_depth = num - 1;
+      bad_chain = 1;
+      if (!call_verify_cb(0, ctx)) {
         goto end;
       }
-      num++;
-      ctx->last_untrusted = num;
-      ctx->current_cert = chain_ss;
-      ctx->error = X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN;
-      chain_ss = NULL;
     }
 
-    ctx->error_depth = num - 1;
-    bad_chain = 1;
-    if (!call_verify_cb(0, ctx)) {
+    // We have the chain complete: now we need to check its purpose
+    if (!check_chain_extensions(ctx) ||  //
+        !check_id(ctx) ||
+        // We check revocation status after copying parameters because they may
+        // be needed for CRL signature verification.
+        !check_revocation(ctx) ||  //
+        !internal_verify(ctx) ||   //
+        !check_name_constraints(ctx) ||
+        // TODO(davidben): Does |check_policy| still need to be conditioned on
+        // |!bad_chain|? DoS concerns have been resolved.
+        (!bad_chain && !check_policy(ctx))) {
       goto end;
     }
-  }
 
-  // We have the chain complete: now we need to check its purpose
-  if (!check_chain_extensions(ctx) ||  //
-      !check_id(ctx) ||
-      // We check revocation status after copying parameters because they may be
-      // needed for CRL signature verification.
-      !check_revocation(ctx) ||  //
-      !internal_verify(ctx) ||   //
-      !check_name_constraints(ctx) ||
-      // TODO(davidben): Does |check_policy| still need to be conditioned on
-      // |!bad_chain|? DoS concerns have been resolved.
-      (!bad_chain && !check_policy(ctx))) {
-    goto end;
+    ok = 1;
   }
 
-  ok = 1;
-
 end:
   sk_X509_free(sktmp);
   X509_free(chain_ss);
@@ -1099,13 +1103,13 @@ static int get_crl(X509_STORE_CTX *ctx, X509_CRL **pcrl, X509 *x) {
   X509 *issuer = NULL;
   int crl_score = 0;
   X509_CRL *crl = NULL;
+  STACK_OF(X509_CRL) *skcrl = NULL;
   if (get_crl_sk(ctx, &crl, &issuer, &crl_score, ctx->crls)) {
     goto done;
   }
 
   // Lookup CRLs from store
-  STACK_OF(X509_CRL) *skcrl =
-      X509_STORE_CTX_get1_crls(ctx, X509_get_issuer_name(x));
+  skcrl = X509_STORE_CTX_get1_crls(ctx, X509_get_issuer_name(x));
 
   // If no CRLs found and a near match from get_crl_sk use that
   if (!skcrl && crl) {
@@ -1117,7 +1121,6 @@ static int get_crl(X509_STORE_CTX *ctx, X509_CRL **pcrl, X509 *x) {
   sk_X509_CRL_pop_free(skcrl, X509_CRL_free);
 
 done:
-
   // If we got any kind of CRL use it and return success
   if (crl) {
     ctx->current_crl_issuer = issuer;
@@ -1515,7 +1518,8 @@ int X509_STORE_CTX_set_trust(X509_STORE_CTX *ctx, int trust) {
 }
 
 X509_STORE_CTX *X509_STORE_CTX_new(void) {
-  return OPENSSL_zalloc(sizeof(X509_STORE_CTX));
+  return reinterpret_cast<X509_STORE_CTX *>(
+      OPENSSL_zalloc(sizeof(X509_STORE_CTX)));
 }
 
 void X509_STORE_CTX_free(X509_STORE_CTX *ctx) {

data/third_party/boringssl-with-bazel/src/crypto/x509/{x509_vpm.c → x509_vpm.cc}

@@ -116,7 +116,8 @@ static int int_x509_param_set_hosts(X509_VERIFY_PARAM *param, int mode,
 }
 
 X509_VERIFY_PARAM *X509_VERIFY_PARAM_new(void) {
-  X509_VERIFY_PARAM *param = OPENSSL_zalloc(sizeof(X509_VERIFY_PARAM));
+  X509_VERIFY_PARAM *param = reinterpret_cast<X509_VERIFY_PARAM *>(
+      OPENSSL_zalloc(sizeof(X509_VERIFY_PARAM)));
   if (!param) {
     return NULL;
   }
@@ -246,7 +247,7 @@ static int int_x509_param_set1(char **pdest, size_t *pdestlen, const char *src,
   if (*pdest) {
     OPENSSL_free(*pdest);
   }
-  *pdest = tmp;
+  *pdest = reinterpret_cast<char *>(tmp);
   if (pdestlen) {
     *pdestlen = srclen;
   }
@@ -397,26 +398,67 @@ int X509_VERIFY_PARAM_get_depth(const X509_VERIFY_PARAM *param) {
 }
 
 static const X509_VERIFY_PARAM kDefaultParam = {
-    .flags = X509_V_FLAG_TRUSTED_FIRST,
-    .depth = 100,
+    /*check_time=*/0,
+    /*flags=*/X509_V_FLAG_TRUSTED_FIRST,
+    /*purpose=*/0,
+    /*trust=*/0,
+    /*depth=*/100,
+    /*policies=*/nullptr,
+    /*hosts=*/nullptr,
+    /*hostflags=*/0,
+    /*email=*/nullptr,
+    /*emaillen=*/0,
+    /*ip=*/nullptr,
+    /*iplen=*/0,
+    /*poison=*/0,
 };
 
 static const X509_VERIFY_PARAM kSMIMESignParam = {
-    .purpose = X509_PURPOSE_SMIME_SIGN,
-    .trust = X509_TRUST_EMAIL,
-    .depth = -1,
+    /*check_time=*/0,
+    /*flags=*/0,
+    /*purpose=*/X509_PURPOSE_SMIME_SIGN,
+    /*trust=*/X509_TRUST_EMAIL,
+    /*depth=*/-1,
+    /*policies=*/nullptr,
+    /*hosts=*/nullptr,
+    /*hostflags=*/0,
+    /*email=*/nullptr,
+    /*emaillen=*/0,
+    /*ip=*/nullptr,
+    /*iplen=*/0,
+    /*poison=*/0,
 };
 
 static const X509_VERIFY_PARAM kSSLClientParam = {
-    .purpose = X509_PURPOSE_SSL_CLIENT,
-    .trust = X509_TRUST_SSL_CLIENT,
-    .depth = -1,
+    /*check_time=*/0,
+    /*flags=*/0,
+    /*purpose=*/X509_PURPOSE_SSL_CLIENT,
+    /*trust=*/X509_TRUST_SSL_CLIENT,
+    /*depth=*/-1,
+    /*policies=*/nullptr,
+    /*hosts=*/nullptr,
+    /*hostflags=*/0,
+    /*email=*/nullptr,
+    /*emaillen=*/0,
+    /*ip=*/nullptr,
+    /*iplen=*/0,
+    /*poison=*/0,
 };
 
 static const X509_VERIFY_PARAM kSSLServerParam = {
-    .purpose = X509_PURPOSE_SSL_SERVER,
-    .trust = X509_TRUST_SSL_SERVER,
-    .depth = -1,
+    /*check_time=*/0,
+    /*flags=*/0,
+    /*purpose=*/X509_PURPOSE_SSL_SERVER,
+    /*trust=*/X509_TRUST_SSL_SERVER,
+    /*depth=*/-1,
+    /*policies=*/nullptr,
+    /*hosts=*/nullptr,
+    /*hostflags=*/0,
+    /*email=*/nullptr,
+    /*emaillen=*/0,
+    /*ip=*/nullptr,
+    /*iplen=*/0,
+    /*poison=*/0,
 };
 
 const X509_VERIFY_PARAM *X509_VERIFY_PARAM_lookup(const char *name) {

data/third_party/boringssl-with-bazel/src/crypto/x509/{x509spki.c → x509spki.cc}

@@ -89,7 +89,7 @@ NETSCAPE_SPKI *NETSCAPE_SPKI_b64_decode(const char *str, ossl_ssize_t len) {
     OPENSSL_PUT_ERROR(X509, X509_R_BASE64_DECODE_ERROR);
     return NULL;
   }
-  if (!(spki_der = OPENSSL_malloc(spki_len))) {
+  if (!(spki_der = reinterpret_cast<uint8_t *>(OPENSSL_malloc(spki_len)))) {
     return NULL;
   }
   if (!EVP_DecodeBase64(spki_der, &spki_len, spki_len, (const uint8_t *)str,
@@ -116,11 +116,11 @@ char *NETSCAPE_SPKI_b64_encode(NETSCAPE_SPKI *spki) {
     OPENSSL_PUT_ERROR(X509, ERR_R_OVERFLOW);
     return NULL;
   }
-  der_spki = OPENSSL_malloc(der_len);
+  der_spki = reinterpret_cast<uint8_t *>(OPENSSL_malloc(der_len));
   if (der_spki == NULL) {
     return NULL;
   }
-  b64_str = OPENSSL_malloc(b64_len);
+  b64_str = reinterpret_cast<char *>(OPENSSL_malloc(b64_len));
   if (b64_str == NULL) {
     OPENSSL_free(der_spki);
     return NULL;

data/third_party/boringssl-with-bazel/src/crypto/x509/{x_all.c → x_all.cc}

@@ -131,7 +131,8 @@ int NETSCAPE_SPKI_verify(NETSCAPE_SPKI *spki, EVP_PKEY *pkey) {
 }
 
 X509_CRL *d2i_X509_CRL_fp(FILE *fp, X509_CRL **crl) {
-  return ASN1_item_d2i_fp(ASN1_ITEM_rptr(X509_CRL), fp, crl);
+  return reinterpret_cast<X509_CRL *>(
+      ASN1_item_d2i_fp(ASN1_ITEM_rptr(X509_CRL), fp, crl));
 }
 
 int i2d_X509_CRL_fp(FILE *fp, X509_CRL *crl) {
@@ -139,7 +140,8 @@ int i2d_X509_CRL_fp(FILE *fp, X509_CRL *crl) {
 }
 
 X509_CRL *d2i_X509_CRL_bio(BIO *bp, X509_CRL **crl) {
-  return ASN1_item_d2i_bio(ASN1_ITEM_rptr(X509_CRL), bp, crl);
+  return reinterpret_cast<X509_CRL *>(
+      ASN1_item_d2i_bio(ASN1_ITEM_rptr(X509_CRL), bp, crl));
 }
 
 int i2d_X509_CRL_bio(BIO *bp, X509_CRL *crl) {
@@ -147,7 +149,8 @@ int i2d_X509_CRL_bio(BIO *bp, X509_CRL *crl) {
 }
 
 X509_REQ *d2i_X509_REQ_fp(FILE *fp, X509_REQ **req) {
-  return ASN1_item_d2i_fp(ASN1_ITEM_rptr(X509_REQ), fp, req);
+  return reinterpret_cast<X509_REQ *>(
+      ASN1_item_d2i_fp(ASN1_ITEM_rptr(X509_REQ), fp, req));
 }
 
 int i2d_X509_REQ_fp(FILE *fp, X509_REQ *req) {
@@ -155,7 +158,8 @@ int i2d_X509_REQ_fp(FILE *fp, X509_REQ *req) {
 }
 
 X509_REQ *d2i_X509_REQ_bio(BIO *bp, X509_REQ **req) {
-  return ASN1_item_d2i_bio(ASN1_ITEM_rptr(X509_REQ), bp, req);
+  return reinterpret_cast<X509_REQ *>(
+      ASN1_item_d2i_bio(ASN1_ITEM_rptr(X509_REQ), bp, req));
 }
 
 int i2d_X509_REQ_bio(BIO *bp, X509_REQ *req) {
@@ -185,8 +189,8 @@ int i2d_X509_REQ_bio(BIO *bp, X509_REQ *req) {
     return ret;                                \
   }
 
-IMPLEMENT_D2I_FP(X509, d2i_X509_fp, d2i_X509_bio);
-IMPLEMENT_I2D_FP(X509, i2d_X509_fp, i2d_X509_bio);
+IMPLEMENT_D2I_FP(X509, d2i_X509_fp, d2i_X509_bio)
+IMPLEMENT_I2D_FP(X509, i2d_X509_fp, i2d_X509_bio)
 
 IMPLEMENT_D2I_FP(RSA, d2i_RSAPrivateKey_fp, d2i_RSAPrivateKey_bio)
 IMPLEMENT_I2D_FP(RSA, i2d_RSAPrivateKey_fp, i2d_RSAPrivateKey_bio)