grpc 1.72.0 → 1.73.0

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/cipher/e_aes.cc.inc

@@ -31,9 +31,6 @@
 #include "internal.h"
 
 
-OPENSSL_MSVC_PRAGMA(warning(push))
-OPENSSL_MSVC_PRAGMA(warning(disable : 4702))  // Unreachable code.
-
 #define AES_GCM_NONCE_LENGTH 12
 
 typedef struct {
@@ -1126,7 +1123,6 @@ struct aead_aes_gcm_tls13_ctx {
   struct aead_aes_gcm_ctx gcm_ctx;
   uint64_t min_next_nonce;
   uint64_t mask;
-  uint8_t first;
 };
 }  // namespace
 
@@ -1143,7 +1139,6 @@ static int aead_aes_gcm_tls13_init(EVP_AEAD_CTX *ctx, const uint8_t *key,
       (struct aead_aes_gcm_tls13_ctx *)&ctx->state;
 
   gcm_ctx->min_next_nonce = 0;
-  gcm_ctx->first = 1;
 
   size_t actual_tag_len;
   if (!aead_aes_gcm_init_impl(&gcm_ctx->gcm_ctx, &actual_tag_len, key, key_len,
@@ -1174,21 +1169,21 @@ static int aead_aes_gcm_tls13_seal_scatter(
   uint64_t given_counter =
       CRYPTO_load_u64_be(nonce + nonce_len - sizeof(uint64_t));
 
-  if (gcm_ctx->first) {
+  if (gcm_ctx->min_next_nonce == 0) {
     // In the first call the sequence number will be zero and therefore the
     // given nonce will be 0 ^ mask = mask.
     gcm_ctx->mask = given_counter;
-    gcm_ctx->first = 0;
-  }
-  given_counter ^= gcm_ctx->mask;
-
-  if (given_counter == UINT64_MAX || given_counter < gcm_ctx->min_next_nonce) {
-    OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_INVALID_NONCE);
-    return 0;
+    gcm_ctx->min_next_nonce = 1;
+  } else {
+    given_counter ^= gcm_ctx->mask;
+    if (given_counter == UINT64_MAX ||
+        given_counter < gcm_ctx->min_next_nonce) {
+      OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_INVALID_NONCE);
+      return 0;
+    }
+    gcm_ctx->min_next_nonce = given_counter + 1;
   }
 
-  gcm_ctx->min_next_nonce = given_counter + 1;
-
   if (!aead_aes_gcm_seal_scatter(ctx, out, out_tag, out_tag_len,
                                  max_out_tag_len, nonce, nonce_len, in, in_len,
                                  extra_in, extra_in_len, ad, ad_len)) {
@@ -1238,5 +1233,3 @@ int EVP_has_aes_hardware(void) {
   return 0;
 #endif
 }
-
-OPENSSL_MSVC_PRAGMA(warning(pop))

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/cipher/internal.h

@@ -12,8 +12,8 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-#ifndef OPENSSL_HEADER_CIPHER_INTERNAL_H
-#define OPENSSL_HEADER_CIPHER_INTERNAL_H
+#ifndef OPENSSL_HEADER_CRYPTO_FIPSMODULE_CIPHER_INTERNAL_H
+#define OPENSSL_HEADER_CRYPTO_FIPSMODULE_CIPHER_INTERNAL_H
 
 #include <openssl/base.h>
 
@@ -110,4 +110,4 @@ struct evp_cipher_st {
 }  // extern C
 #endif
 
-#endif  // OPENSSL_HEADER_CIPHER_INTERNAL_H
+#endif  // OPENSSL_HEADER_CRYPTO_FIPSMODULE_CIPHER_INTERNAL_H

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/delocate.h

@@ -12,8 +12,8 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-#ifndef OPENSSL_HEADER_FIPSMODULE_DELOCATE_H
-#define OPENSSL_HEADER_FIPSMODULE_DELOCATE_H
+#ifndef OPENSSL_HEADER_CRYPTO_FIPSMODULE_DELOCATE_H
+#define OPENSSL_HEADER_CRYPTO_FIPSMODULE_DELOCATE_H
 
 #include <openssl/base.h>
 
@@ -22,11 +22,18 @@
 
 #if !defined(BORINGSSL_SHARED_LIBRARY) && defined(BORINGSSL_FIPS) && \
     !defined(OPENSSL_ASAN) && !defined(OPENSSL_MSAN)
-#define DEFINE_BSS_GET(type, name, init_value)         \
-  static type name __attribute__((used)) = init_value; \
-  extern "C" {                                         \
-  type *name##_bss_get(void) __attribute__((const));   \
-  }
+#define DEFINE_BSS_GET(type, name, init_value)                                 \
+  /* delocate needs C linkage and for |name| to be unique across BCM. */       \
+  extern "C" {                                                                 \
+  extern type bcm_##name;                                                      \
+  type bcm_##name = init_value;                                                \
+  type *bcm_##name##_bss_get(void) __attribute__((const));                     \
+  } /* extern "C" */                                                           \
+                                                                               \
+  /* The getter functions are exported, but static variables are usually named \
+   * with short names. Define a static wrapper function so the caller can use  \
+   * a short name, while the symbol itself is prefixed. */                     \
+  static type *name##_bss_get(void) { return bcm_##name##_bss_get(); }
 // For FIPS builds we require that CRYPTO_ONCE_INIT be zero.
 #define DEFINE_STATIC_ONCE(name) \
   DEFINE_BSS_GET(CRYPTO_once_t, name, CRYPTO_ONCE_INIT)
@@ -89,4 +96,4 @@
 
 #define DEFINE_LOCAL_DATA(type, name) DEFINE_DATA(type, name, static const)
 
-#endif  // OPENSSL_HEADER_FIPSMODULE_DELOCATE_H
+#endif  // OPENSSL_HEADER_CRYPTO_FIPSMODULE_DELOCATE_H

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/dh/check.cc.inc

@@ -17,9 +17,14 @@
 #include <openssl/bn.h>
 #include <openssl/err.h>
 
+#include "../bn/internal.h"
 #include "internal.h"
 
 
+static_assert(OPENSSL_DH_MAX_MODULUS_BITS <=
+                  BN_MONTGOMERY_MAX_WORDS * BN_BITS2,
+              "Max DH size too big for Montgomery arithmetic");
+
 int dh_check_params_fast(const DH *dh) {
   // Most operations scale with p and q.
   if (BN_is_negative(dh->p) || !BN_is_odd(dh->p) ||
@@ -50,13 +55,11 @@ int DH_check_pub_key(const DH *dh, const BIGNUM *pub_key, int *out_flags) {
     return 0;
   }
 
-  BN_CTX *ctx = BN_CTX_new();
+  bssl::UniquePtr<BN_CTX> ctx(BN_CTX_new());
   if (ctx == NULL) {
     return 0;
   }
-  BN_CTX_start(ctx);
-
-  int ok = 0;
+  bssl::BN_CTXScope scope(ctx.get());
 
   // Check |pub_key| is greater than 1.
   if (BN_cmp(pub_key, BN_value_one()) <= 0) {
@@ -64,11 +67,11 @@ int DH_check_pub_key(const DH *dh, const BIGNUM *pub_key, int *out_flags) {
   }
 
   // Check |pub_key| is less than |dh->p| - 1.
-  BIGNUM *tmp = BN_CTX_get(ctx);
+  BIGNUM *tmp = BN_CTX_get(ctx.get());
   if (tmp == NULL ||
       !BN_copy(tmp, dh->p) ||
       !BN_sub_word(tmp, 1)) {
-    goto err;
+    return 0;
   }
   if (BN_cmp(pub_key, tmp) >= 0) {
     *out_flags |= DH_CHECK_PUBKEY_TOO_LARGE;
@@ -78,23 +81,17 @@ int DH_check_pub_key(const DH *dh, const BIGNUM *pub_key, int *out_flags) {
     // Check |pub_key|^|dh->q| is 1 mod |dh->p|. This is necessary for RFC 5114
     // groups which are not safe primes but pick a generator on a prime-order
     // subgroup of size |dh->q|.
-    if (!BN_mod_exp_mont(tmp, pub_key, dh->q, dh->p, ctx, NULL)) {
-      goto err;
+    if (!BN_mod_exp_mont(tmp, pub_key, dh->q, dh->p, ctx.get(), NULL)) {
+      return 0;
     }
     if (!BN_is_one(tmp)) {
       *out_flags |= DH_CHECK_PUBKEY_INVALID;
     }
   }
 
-  ok = 1;
-
-err:
-  BN_CTX_end(ctx);
-  BN_CTX_free(ctx);
-  return ok;
+  return 1;
 }
 
-
 int DH_check(const DH *dh, int *out_flags) {
   *out_flags = 0;
   if (!dh_check_params_fast(dh)) {
@@ -107,23 +104,18 @@ int DH_check(const DH *dh, int *out_flags) {
   //   for 3, p mod 12 == 5
   //   for 5, p mod 10 == 3 or 7
   // should hold.
-  int ok = 0, r;
-  BN_CTX *ctx = NULL;
-  BN_ULONG l;
-  BIGNUM *t1 = NULL, *t2 = NULL;
-
-  ctx = BN_CTX_new();
-  if (ctx == NULL) {
-    goto err;
+  bssl::UniquePtr<BN_CTX> ctx(BN_CTX_new());
+  if (ctx == nullptr) {
+    return 0;
   }
-  BN_CTX_start(ctx);
-  t1 = BN_CTX_get(ctx);
-  if (t1 == NULL) {
-    goto err;
+  bssl::BN_CTXScope scope(ctx.get());
+  BIGNUM *t1 = BN_CTX_get(ctx.get());
+  if (t1 == nullptr) {
+    return 0;
   }
-  t2 = BN_CTX_get(ctx);
-  if (t2 == NULL) {
-    goto err;
+  BIGNUM *t2 = BN_CTX_get(ctx.get());
+  if (t2 == nullptr) {
+    return 0;
   }
 
   if (dh->q) {
@@ -133,39 +125,40 @@ int DH_check(const DH *dh, int *out_flags) {
       *out_flags |= DH_CHECK_NOT_SUITABLE_GENERATOR;
     } else {
       // Check g^q == 1 mod p
-      if (!BN_mod_exp_mont(t1, dh->g, dh->q, dh->p, ctx, NULL)) {
-        goto err;
+      if (!BN_mod_exp_mont(t1, dh->g, dh->q, dh->p, ctx.get(), nullptr)) {
+        return 0;
       }
       if (!BN_is_one(t1)) {
         *out_flags |= DH_CHECK_NOT_SUITABLE_GENERATOR;
       }
     }
-    r = BN_is_prime_ex(dh->q, BN_prime_checks_for_validation, ctx, NULL);
+    int r = BN_is_prime_ex(dh->q, BN_prime_checks_for_validation, ctx.get(),
+                           nullptr);
     if (r < 0) {
-      goto err;
+      return 0;
     }
     if (!r) {
       *out_flags |= DH_CHECK_Q_NOT_PRIME;
     }
     // Check p == 1 mod q  i.e. q divides p - 1
-    if (!BN_div(t1, t2, dh->p, dh->q, ctx)) {
-      goto err;
+    if (!BN_div(t1, t2, dh->p, dh->q, ctx.get())) {
+      return 0;
     }
     if (!BN_is_one(t2)) {
       *out_flags |= DH_CHECK_INVALID_Q_VALUE;
     }
   } else if (BN_is_word(dh->g, DH_GENERATOR_2)) {
-    l = BN_mod_word(dh->p, 24);
+    BN_ULONG l = BN_mod_word(dh->p, 24);
     if (l == (BN_ULONG)-1) {
-      goto err;
+      return 0;
     }
     if (l != 11) {
       *out_flags |= DH_CHECK_NOT_SUITABLE_GENERATOR;
     }
   } else if (BN_is_word(dh->g, DH_GENERATOR_5)) {
-    l = BN_mod_word(dh->p, 10);
+    BN_ULONG l = BN_mod_word(dh->p, 10);
     if (l == (BN_ULONG)-1) {
-      goto err;
+      return 0;
     }
     if (l != 3 && l != 7) {
       *out_flags |= DH_CHECK_NOT_SUITABLE_GENERATOR;
@@ -174,30 +167,24 @@ int DH_check(const DH *dh, int *out_flags) {
     *out_flags |= DH_CHECK_UNABLE_TO_CHECK_GENERATOR;
   }
 
-  r = BN_is_prime_ex(dh->p, BN_prime_checks_for_validation, ctx, NULL);
+  int r =
+      BN_is_prime_ex(dh->p, BN_prime_checks_for_validation, ctx.get(), nullptr);
   if (r < 0) {
-    goto err;
+    return 0;
   }
   if (!r) {
     *out_flags |= DH_CHECK_P_NOT_PRIME;
   } else if (!dh->q) {
     if (!BN_rshift1(t1, dh->p)) {
-      goto err;
+      return 0;
     }
-    r = BN_is_prime_ex(t1, BN_prime_checks_for_validation, ctx, NULL);
+    r = BN_is_prime_ex(t1, BN_prime_checks_for_validation, ctx.get(), nullptr);
     if (r < 0) {
-      goto err;
+      return 0;
     }
     if (!r) {
       *out_flags |= DH_CHECK_P_NOT_SAFE_PRIME;
     }
   }
-  ok = 1;
-
-err:
-  if (ctx != NULL) {
-    BN_CTX_end(ctx);
-    BN_CTX_free(ctx);
-  }
-  return ok;
+  return 1;
 }

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/dh/dh.cc.inc

@@ -147,28 +147,27 @@ int DH_generate_key(DH *dh) {
   }
 
   int ok = 0;
-  int generate_new_key = 0;
-  BN_CTX *ctx = NULL;
-  BIGNUM *pub_key = NULL, *priv_key = NULL, *priv_key_limit = NULL;
+  bool generate_new_key = false;
+  BIGNUM *pub_key = nullptr, *priv_key = nullptr;
 
-  ctx = BN_CTX_new();
-  if (ctx == NULL) {
+  bssl::UniquePtr<BN_CTX> ctx(BN_CTX_new());
+  if (ctx == nullptr) {
     goto err;
   }
 
-  if (dh->priv_key == NULL) {
+  if (dh->priv_key == nullptr) {
     priv_key = BN_new();
-    if (priv_key == NULL) {
+    if (priv_key == nullptr) {
       goto err;
     }
-    generate_new_key = 1;
+    generate_new_key = true;
   } else {
     priv_key = dh->priv_key;
   }
 
-  if (dh->pub_key == NULL) {
+  if (dh->pub_key == nullptr) {
     pub_key = BN_new();
-    if (pub_key == NULL) {
+    if (pub_key == nullptr) {
       goto err;
     }
   } else {
@@ -176,7 +175,7 @@ int DH_generate_key(DH *dh) {
   }
 
   if (!BN_MONT_CTX_set_locked(&dh->method_mont_p, &dh->method_mont_p_lock,
-                              dh->p, ctx)) {
+                              dh->p, ctx.get())) {
     goto err;
   }
 
@@ -202,30 +201,30 @@ int DH_generate_key(DH *dh) {
       // clamp |dh->priv_length| before invoking the algorithm.
 
       // Compute M = min(2^N, q).
-      priv_key_limit = BN_new();
-      if (priv_key_limit == NULL) {
+      bssl::UniquePtr<BIGNUM> priv_key_limit(BN_new());
+      if (priv_key_limit == nullptr) {
         goto err;
       }
       if (dh->priv_length == 0 || dh->priv_length >= BN_num_bits(dh->p) - 1) {
         // M = q = (p - 1) / 2.
-        if (!BN_rshift1(priv_key_limit, dh->p)) {
+        if (!BN_rshift1(priv_key_limit.get(), dh->p)) {
           goto err;
         }
       } else {
         // M = 2^N.
-        if (!BN_set_bit(priv_key_limit, dh->priv_length)) {
+        if (!BN_set_bit(priv_key_limit.get(), dh->priv_length)) {
           goto err;
         }
       }
 
       // Choose a private key uniformly from [1, M-1].
-      if (!BN_rand_range_ex(priv_key, 1, priv_key_limit)) {
+      if (!BN_rand_range_ex(priv_key, 1, priv_key_limit.get())) {
         goto err;
       }
     }
   }
 
-  if (!BN_mod_exp_mont_consttime(pub_key, dh->g, priv_key, dh->p, ctx,
+  if (!BN_mod_exp_mont_consttime(pub_key, dh->g, priv_key, dh->p, ctx.get(),
                                  dh->method_mont_p)) {
     goto err;
   }
@@ -239,14 +238,12 @@ err:
     OPENSSL_PUT_ERROR(DH, ERR_R_BN_LIB);
   }
 
-  if (dh->pub_key == NULL) {
+  if (dh->pub_key == nullptr) {
     BN_free(pub_key);
   }
-  if (dh->priv_key == NULL) {
+  if (dh->priv_key == nullptr) {
     BN_free(priv_key);
   }
-  BN_free(priv_key_limit);
-  BN_CTX_free(ctx);
   return ok;
 }
 
@@ -267,56 +264,46 @@ static int dh_compute_key(DH *dh, BIGNUM *out_shared_key,
     return 0;
   }
 
-  int ret = 0;
-  BN_CTX_start(ctx);
+  bssl::BN_CTXScope scope(ctx);
   BIGNUM *p_minus_1 = BN_CTX_get(ctx);
-
   if (!p_minus_1 ||
       !BN_MONT_CTX_set_locked(&dh->method_mont_p, &dh->method_mont_p_lock,
                               dh->p, ctx)) {
-    goto err;
+    return 0;
   }
 
   if (!BN_mod_exp_mont_consttime(out_shared_key, peers_key, dh->priv_key, dh->p,
                                  ctx, dh->method_mont_p) ||
       !BN_copy(p_minus_1, dh->p) || !BN_sub_word(p_minus_1, 1)) {
     OPENSSL_PUT_ERROR(DH, ERR_R_BN_LIB);
-    goto err;
+    return 0;
   }
 
   // This performs the check required by SP 800-56Ar3 section 5.7.1.1 step two.
   if (BN_cmp_word(out_shared_key, 1) <= 0 ||
       BN_cmp(out_shared_key, p_minus_1) == 0) {
     OPENSSL_PUT_ERROR(DH, DH_R_INVALID_PUBKEY);
-    goto err;
+    return 0;
   }
 
-  ret = 1;
-
-err:
-  BN_CTX_end(ctx);
-  return ret;
+  return 1;
 }
 
 int dh_compute_key_padded_no_self_test(unsigned char *out,
                                        const BIGNUM *peers_key, DH *dh) {
-  BN_CTX *ctx = BN_CTX_new();
-  if (ctx == NULL) {
+  bssl::UniquePtr<BN_CTX> ctx(BN_CTX_new());
+  if (ctx == nullptr) {
     return -1;
   }
-  BN_CTX_start(ctx);
-
+  bssl::BN_CTXScope scope(ctx.get());
   int dh_size = DH_size(dh);
-  int ret = -1;
-  BIGNUM *shared_key = BN_CTX_get(ctx);
-  if (shared_key && dh_compute_key(dh, shared_key, peers_key, ctx) &&
-      BN_bn2bin_padded(out, dh_size, shared_key)) {
-    ret = dh_size;
+  BIGNUM *shared_key = BN_CTX_get(ctx.get());
+  if (shared_key == nullptr ||
+      !dh_compute_key(dh, shared_key, peers_key, ctx.get()) ||
+      !BN_bn2bin_padded(out, dh_size, shared_key)) {
+    return -1;
   }
-
-  BN_CTX_end(ctx);
-  BN_CTX_free(ctx);
-  return ret;
+  return dh_size;
 }
 
 int DH_compute_key_padded(unsigned char *out, const BIGNUM *peers_key, DH *dh) {
@@ -328,22 +315,18 @@ int DH_compute_key_padded(unsigned char *out, const BIGNUM *peers_key, DH *dh) {
 int DH_compute_key(unsigned char *out, const BIGNUM *peers_key, DH *dh) {
   boringssl_ensure_ffdh_self_test();
 
-  BN_CTX *ctx = BN_CTX_new();
-  if (ctx == NULL) {
+  bssl::UniquePtr<BN_CTX> ctx(BN_CTX_new());
+  if (ctx == nullptr) {
     return -1;
   }
-  BN_CTX_start(ctx);
-
-  int ret = -1;
-  BIGNUM *shared_key = BN_CTX_get(ctx);
-  if (shared_key && dh_compute_key(dh, shared_key, peers_key, ctx)) {
-    // A |BIGNUM|'s byte count fits in |int|.
-    ret = (int)BN_bn2bin(shared_key, out);
+  bssl::BN_CTXScope scope(ctx.get());
+  BIGNUM *shared_key = BN_CTX_get(ctx.get());
+  if (shared_key == nullptr ||
+      !dh_compute_key(dh, shared_key, peers_key, ctx.get())) {
+    return -1;
   }
-
-  BN_CTX_end(ctx);
-  BN_CTX_free(ctx);
-  return ret;
+  // A |BIGNUM|'s byte count fits in |int|.
+  return static_cast<int>(BN_bn2bin(shared_key, out));
 }
 
 int DH_compute_key_hashed(DH *dh, uint8_t *out, size_t *out_len,
@@ -415,29 +398,27 @@ DH *DH_get_rfc7919_2048(void) {
       TOBN(0xadf85458, 0xa2bb4a9a), TOBN(0xffffffff, 0xffffffff),
   };
 
-  BIGNUM *const ffdhe2048_p = BN_new();
-  BIGNUM *const ffdhe2048_q = BN_new();
-  BIGNUM *const ffdhe2048_g = BN_new();
-  DH *const dh = DH_new();
-
+  bssl::UniquePtr<BIGNUM> ffdhe2048_p(BN_new());
+  bssl::UniquePtr<BIGNUM> ffdhe2048_q(BN_new());
+  bssl::UniquePtr<BIGNUM> ffdhe2048_g(BN_new());
+  bssl::UniquePtr<DH> dh(DH_new());
   if (!ffdhe2048_p || !ffdhe2048_q || !ffdhe2048_g || !dh) {
-    goto err;
+    return nullptr;
   }
 
-  bn_set_static_words(ffdhe2048_p, kFFDHE2048Data,
+  bn_set_static_words(ffdhe2048_p.get(), kFFDHE2048Data,
                       OPENSSL_ARRAY_SIZE(kFFDHE2048Data));
 
-  if (!BN_rshift1(ffdhe2048_q, ffdhe2048_p) || !BN_set_word(ffdhe2048_g, 2) ||
-      !DH_set0_pqg(dh, ffdhe2048_p, ffdhe2048_q, ffdhe2048_g)) {
-    goto err;
+  if (!BN_rshift1(ffdhe2048_q.get(), ffdhe2048_p.get()) ||
+      !BN_set_word(ffdhe2048_g.get(), 2) ||
+      !DH_set0_pqg(dh.get(), ffdhe2048_p.get(), ffdhe2048_q.get(),
+                   ffdhe2048_g.get())) {
+    return nullptr;
   }
+  // |DH_set0_pqg| takes ownership on success.
+  ffdhe2048_p.release();
+  ffdhe2048_q.release();
+  ffdhe2048_g.release();
 
-  return dh;
-
-err:
-  BN_free(ffdhe2048_p);
-  BN_free(ffdhe2048_q);
-  BN_free(ffdhe2048_g);
-  DH_free(dh);
-  return NULL;
+  return dh.release();
 }

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/digest/digest.cc.inc

@@ -212,16 +212,10 @@ int EVP_DigestFinal(EVP_MD_CTX *ctx, uint8_t *md, unsigned int *size) {
 
 int EVP_Digest(const void *data, size_t count, uint8_t *out_md,
                unsigned int *out_size, const EVP_MD *type, ENGINE *impl) {
-  EVP_MD_CTX ctx;
-  int ret;
-
-  EVP_MD_CTX_init(&ctx);
-  ret = EVP_DigestInit_ex(&ctx, type, impl) &&
-        EVP_DigestUpdate(&ctx, data, count) &&
-        EVP_DigestFinal_ex(&ctx, out_md, out_size);
-  EVP_MD_CTX_cleanup(&ctx);
-
-  return ret;
+  bssl::ScopedEVP_MD_CTX ctx;
+  return EVP_DigestInit_ex(ctx.get(), type, impl) &&
+         EVP_DigestUpdate(ctx.get(), data, count) &&
+         EVP_DigestFinal_ex(ctx.get(), out_md, out_size);
 }
 
 const EVP_MD *EVP_MD_CTX_get0_md(const EVP_MD_CTX *ctx) {

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/digest/internal.h

@@ -12,8 +12,8 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-#ifndef OPENSSL_HEADER_DIGEST_INTERNAL_H
-#define OPENSSL_HEADER_DIGEST_INTERNAL_H
+#ifndef OPENSSL_HEADER_CRYPTO_FIPSMODULE_DIGEST_INTERNAL_H
+#define OPENSSL_HEADER_CRYPTO_FIPSMODULE_DIGEST_INTERNAL_H
 
 #include <openssl/base.h>
 
@@ -67,4 +67,4 @@ struct evp_md_pctx_ops {
 }  // extern C
 #endif
 
-#endif  // OPENSSL_HEADER_DIGEST_INTERNAL
+#endif  // OPENSSL_HEADER_CRYPTO_FIPSMODULE_DIGEST_INTERNAL_H

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/digest/md32_common.h

@@ -12,8 +12,8 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-#ifndef OPENSSL_HEADER_DIGEST_MD32_COMMON_H
-#define OPENSSL_HEADER_DIGEST_MD32_COMMON_H
+#ifndef OPENSSL_HEADER_CRYPTO_FIPSMODULE_DIGEST_MD32_COMMON_H
+#define OPENSSL_HEADER_CRYPTO_FIPSMODULE_DIGEST_MD32_COMMON_H
 
 #include <openssl/base.h>
 
@@ -158,4 +158,4 @@ static inline void crypto_md32_final(crypto_md32_block_func block_func,
 }  // extern C
 #endif
 
-#endif  // OPENSSL_HEADER_DIGEST_MD32_COMMON_H
+#endif  // OPENSSL_HEADER_CRYPTO_FIPSMODULE_DIGEST_MD32_COMMON_H