grpc 1.72.0 → 1.74.0.pre2

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/bn/gcd.cc.inc

@@ -33,23 +33,20 @@ int BN_mod_inverse_odd(BIGNUM *out, int *out_no_inverse, const BIGNUM *a,
     return 0;
   }
 
-  BIGNUM *A, *B, *X, *Y;
-  int ret = 0;
   int sign;
-
-  BN_CTX_start(ctx);
-  A = BN_CTX_get(ctx);
-  B = BN_CTX_get(ctx);
-  X = BN_CTX_get(ctx);
-  Y = BN_CTX_get(ctx);
+  bssl::BN_CTXScope scope(ctx);
+  BIGNUM *A = BN_CTX_get(ctx);
+  BIGNUM *B = BN_CTX_get(ctx);
+  BIGNUM *X = BN_CTX_get(ctx);
+  BIGNUM *Y = BN_CTX_get(ctx);
   BIGNUM *R = out;
   if (Y == NULL) {
-    goto err;
+    return 0;
   }
 
   BN_zero(Y);
   if (!BN_one(X) || BN_copy(B, a) == NULL || BN_copy(A, n) == NULL) {
-    goto err;
+    return 0;
   }
   A->neg = 0;
   sign = -1;
@@ -80,17 +77,17 @@ int BN_mod_inverse_odd(BIGNUM *out, int *out_no_inverse, const BIGNUM *a,
 
       if (BN_is_odd(X)) {
         if (!BN_uadd(X, X, n)) {
-          goto err;
+          return 0;
         }
       }
       // now X is even, so we can easily divide it by two
       if (!BN_rshift1(X, X)) {
-        goto err;
+        return 0;
       }
     }
     if (shift > 0) {
       if (!BN_rshift(B, B, shift)) {
-        goto err;
+        return 0;
       }
     }
 
@@ -102,17 +99,17 @@ int BN_mod_inverse_odd(BIGNUM *out, int *out_no_inverse, const BIGNUM *a,
 
       if (BN_is_odd(Y)) {
         if (!BN_uadd(Y, Y, n)) {
-          goto err;
+          return 0;
         }
       }
       // now Y is even
       if (!BN_rshift1(Y, Y)) {
-        goto err;
+        return 0;
       }
     }
     if (shift > 0) {
       if (!BN_rshift(A, A, shift)) {
-        goto err;
+        return 0;
       }
     }
 
@@ -129,21 +126,21 @@ int BN_mod_inverse_odd(BIGNUM *out, int *out_no_inverse, const BIGNUM *a,
     if (BN_ucmp(B, A) >= 0) {
       // -sign*(X + Y)*a == B - A  (mod |n|)
       if (!BN_uadd(X, X, Y)) {
-        goto err;
+        return 0;
       }
       // NB: we could use BN_mod_add_quick(X, X, Y, n), but that
       // actually makes the algorithm slower
       if (!BN_usub(B, B, A)) {
-        goto err;
+        return 0;
       }
     } else {
       //  sign*(X + Y)*a == A - B  (mod |n|)
       if (!BN_uadd(Y, Y, X)) {
-        goto err;
+        return 0;
       }
       // as above, BN_mod_add_quick(Y, Y, X, n) would slow things down
       if (!BN_usub(A, A, B)) {
-        goto err;
+        return 0;
       }
     }
   }
@@ -151,7 +148,7 @@ int BN_mod_inverse_odd(BIGNUM *out, int *out_no_inverse, const BIGNUM *a,
   if (!BN_is_one(A)) {
     *out_no_inverse = 1;
     OPENSSL_PUT_ERROR(BN, BN_R_NO_INVERSE);
-    goto err;
+    return 0;
   }
 
   // The while loop (Euclid's algorithm) ends when
@@ -162,7 +159,7 @@ int BN_mod_inverse_odd(BIGNUM *out, int *out_no_inverse, const BIGNUM *a,
 
   if (sign < 0) {
     if (!BN_sub(Y, n, Y)) {
-      goto err;
+      return 0;
     }
   }
   // Now  Y*a  ==  A  (mod |n|).
@@ -170,61 +167,49 @@ int BN_mod_inverse_odd(BIGNUM *out, int *out_no_inverse, const BIGNUM *a,
   // Y*a == 1  (mod |n|)
   if (Y->neg || BN_ucmp(Y, n) >= 0) {
     if (!BN_nnmod(Y, Y, n, ctx)) {
-      goto err;
+      return 0;
     }
   }
   if (!BN_copy(R, Y)) {
-    goto err;
+    return 0;
   }
 
-  ret = 1;
-
-err:
-  BN_CTX_end(ctx);
-  return ret;
+  return 1;
 }
 
 BIGNUM *BN_mod_inverse(BIGNUM *out, const BIGNUM *a, const BIGNUM *n,
                        BN_CTX *ctx) {
-  BIGNUM *new_out = NULL;
-  if (out == NULL) {
-    new_out = BN_new();
-    if (new_out == NULL) {
-      return NULL;
+  bssl::UniquePtr<BIGNUM> new_out;
+  if (out == nullptr) {
+    new_out.reset(BN_new());
+    if (new_out == nullptr) {
+      return nullptr;
     }
-    out = new_out;
+    out = new_out.get();
   }
 
-  int ok = 0;
-  BIGNUM *a_reduced = NULL;
+  bssl::UniquePtr<BIGNUM> a_reduced;
   if (a->neg || BN_ucmp(a, n) >= 0) {
-    a_reduced = BN_dup(a);
-    if (a_reduced == NULL) {
-      goto err;
+    a_reduced.reset(BN_dup(a));
+    if (a_reduced == nullptr) {
+      return nullptr;
     }
-    if (!BN_nnmod(a_reduced, a_reduced, n, ctx)) {
-      goto err;
+    if (!BN_nnmod(a_reduced.get(), a_reduced.get(), n, ctx)) {
+      return nullptr;
     }
-    a = a_reduced;
+    a = a_reduced.get();
   }
 
   int no_inverse;
   if (!BN_is_odd(n)) {
     if (!bn_mod_inverse_consttime(out, &no_inverse, a, n, ctx)) {
-      goto err;
+      return nullptr;
     }
   } else if (!BN_mod_inverse_odd(out, &no_inverse, a, n, ctx)) {
-    goto err;
+    return nullptr;
   }
 
-  ok = 1;
-
-err:
-  if (!ok) {
-    BN_free(new_out);
-    out = NULL;
-  }
-  BN_free(a_reduced);
+  new_out.release();  // Passed to the caller via |out|.
   return out;
 }
 
@@ -240,9 +225,10 @@ int BN_mod_inverse_blinded(BIGNUM *out, int *out_no_inverse, const BIGNUM *a,
     return 0;
   }
 
-  int ret = 0;
-  BIGNUM blinding_factor;
-  BN_init(&blinding_factor);
+  bssl::UniquePtr<BIGNUM> blinding_factor(BN_new());
+  if (blinding_factor == nullptr) {
+    return 0;
+  }
 
   // |BN_mod_inverse_odd| is leaky, so generate a secret blinding factor and
   // blind |a|. This works because (ar)^-1 * r = a^-1, supposing r is
@@ -253,12 +239,12 @@ int BN_mod_inverse_blinded(BIGNUM *out, int *out_no_inverse, const BIGNUM *a,
   //
   // TODO(crbug.com/boringssl/677): When the PRNG output is marked secret by
   // default, the explicit |bn_secret| call can be removed.
-  if (!BN_rand_range_ex(&blinding_factor, 1, &mont->N)) {
-    goto err;
+  if (!BN_rand_range_ex(blinding_factor.get(), 1, &mont->N)) {
+    return 0;
   }
-  bn_secret(&blinding_factor);
-  if (!BN_mod_mul_montgomery(out, &blinding_factor, a, mont, ctx)) {
-    goto err;
+  bn_secret(blinding_factor.get());
+  if (!BN_mod_mul_montgomery(out, blinding_factor.get(), a, mont, ctx)) {
+    return 0;
   }
 
   // Once blinded, |out| is no longer secret, so it may be passed to a leaky
@@ -266,35 +252,27 @@ int BN_mod_inverse_blinded(BIGNUM *out, int *out_no_inverse, const BIGNUM *a,
   // secret again after multiplying.
   bn_declassify(out);
   if (!BN_mod_inverse_odd(out, out_no_inverse, out, &mont->N, ctx) ||
-      !BN_mod_mul_montgomery(out, &blinding_factor, out, mont, ctx)) {
-    goto err;
+      !BN_mod_mul_montgomery(out, blinding_factor.get(), out, mont, ctx)) {
+    return 0;
   }
 
-  ret = 1;
-
-err:
-  BN_free(&blinding_factor);
-  return ret;
+  return 1;
 }
 
 int bn_mod_inverse_prime(BIGNUM *out, const BIGNUM *a, const BIGNUM *p,
                          BN_CTX *ctx, const BN_MONT_CTX *mont_p) {
-  BN_CTX_start(ctx);
+  bssl::BN_CTXScope scope(ctx);
   BIGNUM *p_minus_2 = BN_CTX_get(ctx);
-  int ok = p_minus_2 != NULL && BN_copy(p_minus_2, p) &&
-           BN_sub_word(p_minus_2, 2) &&
-           BN_mod_exp_mont(out, a, p_minus_2, p, ctx, mont_p);
-  BN_CTX_end(ctx);
-  return ok;
+  return p_minus_2 != nullptr && BN_copy(p_minus_2, p) &&
+         BN_sub_word(p_minus_2, 2) &&
+         BN_mod_exp_mont(out, a, p_minus_2, p, ctx, mont_p);
 }
 
 int bn_mod_inverse_secret_prime(BIGNUM *out, const BIGNUM *a, const BIGNUM *p,
                                 BN_CTX *ctx, const BN_MONT_CTX *mont_p) {
-  BN_CTX_start(ctx);
+  bssl::BN_CTXScope scope(ctx);
   BIGNUM *p_minus_2 = BN_CTX_get(ctx);
-  int ok = p_minus_2 != NULL && BN_copy(p_minus_2, p) &&
-           BN_sub_word(p_minus_2, 2) &&
-           BN_mod_exp_mont_consttime(out, a, p_minus_2, p, ctx, mont_p);
-  BN_CTX_end(ctx);
-  return ok;
+  return p_minus_2 != nullptr && BN_copy(p_minus_2, p) &&
+         BN_sub_word(p_minus_2, 2) &&
+         BN_mod_exp_mont_consttime(out, a, p_minus_2, p, ctx, mont_p);
 }

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/bn/gcd_extra.cc.inc

@@ -56,19 +56,18 @@ static int bn_gcd_consttime(BIGNUM *r, unsigned *out_shift, const BIGNUM *x,
   }
 
   // This is a constant-time implementation of Stein's algorithm (binary GCD).
-  int ret = 0;
-  BN_CTX_start(ctx);
+  bssl::BN_CTXScope scope(ctx);
   BIGNUM *u = BN_CTX_get(ctx);
   BIGNUM *v = BN_CTX_get(ctx);
   BIGNUM *tmp = BN_CTX_get(ctx);
   unsigned x_bits, y_bits, num_iters, shift;
-  if (u == NULL || v == NULL || tmp == NULL ||  //
+  if (u == nullptr || v == nullptr || tmp == nullptr ||  //
       !BN_copy(u, x) ||                         //
       !BN_copy(v, y) ||                         //
       !bn_resize_words(u, width) ||             //
       !bn_resize_words(v, width) ||             //
       !bn_resize_words(tmp, width)) {
-    goto err;
+    return 0;
   }
 
   // Each loop iteration halves at least one of |u| and |v|. Thus we need at
@@ -78,7 +77,7 @@ static int bn_gcd_consttime(BIGNUM *r, unsigned *out_shift, const BIGNUM *x,
   num_iters = x_bits + y_bits;
   if (num_iters < x_bits) {
     OPENSSL_PUT_ERROR(BN, BN_R_BIGNUM_TOO_LONG);
-    goto err;
+    return 0;
   }
 
   shift = 0;
@@ -114,11 +113,7 @@ static int bn_gcd_consttime(BIGNUM *r, unsigned *out_shift, const BIGNUM *x,
   }
 
   *out_shift = shift;
-  ret = bn_set_words(r, v->d, width);
-
-err:
-  BN_CTX_end(ctx);
-  return ret;
+  return bn_set_words(r, v->d, width);
 }
 
 int BN_gcd(BIGNUM *r, const BIGNUM *x, const BIGNUM *y, BN_CTX *ctx) {
@@ -128,12 +123,11 @@ int BN_gcd(BIGNUM *r, const BIGNUM *x, const BIGNUM *y, BN_CTX *ctx) {
 
 int bn_is_relatively_prime(int *out_relatively_prime, const BIGNUM *x,
                            const BIGNUM *y, BN_CTX *ctx) {
-  int ret = 0;
-  BN_CTX_start(ctx);
+  bssl::BN_CTXScope scope(ctx);
   unsigned shift;
   BIGNUM *gcd = BN_CTX_get(ctx);
-  if (gcd == NULL || !bn_gcd_consttime(gcd, &shift, x, y, ctx)) {
-    goto err;
+  if (gcd == nullptr || !bn_gcd_consttime(gcd, &shift, x, y, ctx)) {
+    return 0;
   }
 
   // Check that 2^|shift| * |gcd| is one.
@@ -146,25 +140,20 @@ int bn_is_relatively_prime(int *out_relatively_prime, const BIGNUM *x,
     }
     *out_relatively_prime = mask == 0;
   }
-  ret = 1;
 
-err:
-  BN_CTX_end(ctx);
-  return ret;
+  return 1;
 }
 
 int bn_lcm_consttime(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx) {
-  BN_CTX_start(ctx);
+  bssl::BN_CTXScope scope(ctx);
   unsigned shift;
   BIGNUM *gcd = BN_CTX_get(ctx);
-  int ret = gcd != NULL &&  //
-            bn_mul_consttime(r, a, b, ctx) &&
-            bn_gcd_consttime(gcd, &shift, a, b, ctx) &&
-            // |gcd| has a secret bit width.
-            bn_div_consttime(r, NULL, r, gcd, /*divisor_min_bits=*/0, ctx) &&
-            bn_rshift_secret_shift(r, r, shift, ctx);
-  BN_CTX_end(ctx);
-  return ret;
+  return gcd != nullptr &&  //
+         bn_mul_consttime(r, a, b, ctx) &&
+         bn_gcd_consttime(gcd, &shift, a, b, ctx) &&
+         // |gcd| has a secret bit width.
+         bn_div_consttime(r, nullptr, r, gcd, /*divisor_min_bits=*/0, ctx) &&
+         bn_rshift_secret_shift(r, r, shift, ctx);
 }
 
 int bn_mod_inverse_consttime(BIGNUM *r, int *out_no_inverse, const BIGNUM *a,
@@ -207,8 +196,7 @@ int bn_mod_inverse_consttime(BIGNUM *r, int *out_no_inverse, const BIGNUM *a,
     a_width = n_width;
   }
 
-  int ret = 0;
-  BN_CTX_start(ctx);
+  bssl::BN_CTXScope scope(ctx);
   BIGNUM *u = BN_CTX_get(ctx);
   BIGNUM *v = BN_CTX_get(ctx);
   BIGNUM *A = BN_CTX_get(ctx);
@@ -218,14 +206,14 @@ int bn_mod_inverse_consttime(BIGNUM *r, int *out_no_inverse, const BIGNUM *a,
   BIGNUM *tmp = BN_CTX_get(ctx);
   BIGNUM *tmp2 = BN_CTX_get(ctx);
   size_t a_bits, num_iters, n_bits;
-  if (u == NULL ||       //
-      v == NULL ||       //
-      A == NULL ||       //
-      B == NULL ||       //
-      C == NULL ||       //
-      D == NULL ||       //
-      tmp == NULL ||     //
-      tmp2 == NULL ||    //
+  if (u == nullptr ||       //
+      v == nullptr ||       //
+      A == nullptr ||       //
+      B == nullptr ||       //
+      C == nullptr ||       //
+      D == nullptr ||       //
+      tmp == nullptr ||     //
+      tmp2 == nullptr ||    //
       !BN_copy(u, a) ||  //
       !BN_copy(v, n) ||  //
       !BN_one(A) ||      //
@@ -242,7 +230,7 @@ int bn_mod_inverse_consttime(BIGNUM *r, int *out_no_inverse, const BIGNUM *a,
       // |tmp| and |tmp2| may be used at either size.
       !bn_resize_words(tmp, n_width) ||  //
       !bn_resize_words(tmp2, n_width)) {
-    goto err;
+    return 0;
   }
 
   // Each loop iteration halves at least one of |u| and |v|. Thus we need at
@@ -254,7 +242,7 @@ int bn_mod_inverse_consttime(BIGNUM *r, int *out_no_inverse, const BIGNUM *a,
   num_iters = a_bits + n_bits;
   if (num_iters < a_bits) {
     OPENSSL_PUT_ERROR(BN, BN_R_BIGNUM_TOO_LONG);
-    goto err;
+    return 0;
   }
 
   // Before and after each loop iteration, the following hold:
@@ -328,12 +316,8 @@ int bn_mod_inverse_consttime(BIGNUM *r, int *out_no_inverse, const BIGNUM *a,
   if (constant_time_declassify_int(!BN_is_one(u))) {
     *out_no_inverse = 1;
     OPENSSL_PUT_ERROR(BN, BN_R_NO_INVERSE);
-    goto err;
+    return 0;
   }
 
-  ret = BN_copy(r, A) != NULL;
-
-err:
-  BN_CTX_end(ctx);
-  return ret;
+  return BN_copy(r, A) != nullptr;
 }

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/bn/internal.h

@@ -13,15 +13,13 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-#ifndef OPENSSL_HEADER_BN_INTERNAL_H
-#define OPENSSL_HEADER_BN_INTERNAL_H
+#ifndef OPENSSL_HEADER_CRYPTO_FIPSMODULE_BN_INTERNAL_H
+#define OPENSSL_HEADER_CRYPTO_FIPSMODULE_BN_INTERNAL_H
 
 #include <openssl/bn.h>
 
 #if defined(OPENSSL_X86_64) && defined(_MSC_VER)
-OPENSSL_MSVC_PRAGMA(warning(push, 3))
 #include <intrin.h>
-OPENSSL_MSVC_PRAGMA(warning(pop))
 #pragma intrinsic(__umulh, _umul128)
 #endif
 
@@ -263,11 +261,15 @@ int bn_rand_range_words(BN_ULONG *out, BN_ULONG min_inclusive,
 int bn_rand_secret_range(BIGNUM *r, int *out_is_uniform, BN_ULONG min_inclusive,
                          const BIGNUM *max_exclusive);
 
-// BN_MONTGOMERY_MAX_WORDS is the maximum numer of words allowed in a |BIGNUM|
+// BN_MONTGOMERY_MAX_WORDS is the maximum number of words allowed in a |BIGNUM|
 // used with Montgomery reduction. Ideally this limit would be applied to all
 // |BIGNUM|s, in |bn_wexpand|, but the exactfloat library needs to create 8 MiB
 // values for other operations.
-#define BN_MONTGOMERY_MAX_WORDS (8 * 1024 / sizeof(BN_ULONG))
+//
+// TODO(crbug.com/402677800): This is not quite tight enough to limit the
+// |bn_mul_mont| allocation to under a page. Lower the maximum RSA key and then
+// lower this to match.
+#define BN_MONTGOMERY_MAX_WORDS (16384 / BN_BITS2)
 
 #if !defined(OPENSSL_NO_ASM) &&                         \
     (defined(OPENSSL_X86) || defined(OPENSSL_X86_64) || \
@@ -275,14 +277,14 @@ int bn_rand_secret_range(BIGNUM *r, int *out_is_uniform, BN_ULONG min_inclusive,
 #define OPENSSL_BN_ASM_MONT
 // bn_mul_mont writes |ap| * |bp| mod |np| to |rp|, each |num| words
 // long. Inputs and outputs are in Montgomery form. |n0| is a pointer to the
-// corresponding field in |BN_MONT_CTX|. It returns one if |bn_mul_mont| handles
-// inputs of this size and zero otherwise.
+// corresponding field in |BN_MONT_CTX|.
 //
 // If at least one of |ap| or |bp| is fully reduced, |rp| will be fully reduced.
 // If neither is fully-reduced, the output may not be either.
 //
-// This function allocates |num| words on the stack, so |num| should be at most
-// |BN_MONTGOMERY_MAX_WORDS|.
+// This function allocates up to 2 * |num| words (plus a constant allocation) on
+// the stack, so |num| should be at most |BN_MONTGOMERY_MAX_WORDS|.
+// Additionally, |num| must be at least 128 / |BN_BITS2|.
 //
 // TODO(davidben): The x86_64 implementation expects a 32-bit input and masks
 // off upper bits. The aarch64 implementation expects a 64-bit input and does
@@ -291,39 +293,39 @@ int bn_rand_secret_range(BIGNUM *r, int *out_is_uniform, BN_ULONG min_inclusive,
 //
 // See also discussion in |ToWord| in abi_test.h for notes on smaller-than-word
 // inputs.
-int bn_mul_mont(BN_ULONG *rp, const BN_ULONG *ap, const BN_ULONG *bp,
-                const BN_ULONG *np, const BN_ULONG *n0, size_t num);
+void bn_mul_mont(BN_ULONG *rp, const BN_ULONG *ap, const BN_ULONG *bp,
+                 const BN_ULONG *np, const BN_ULONG *n0, size_t num);
 
 #if defined(OPENSSL_X86_64)
 inline int bn_mulx_adx_capable(void) {
   // MULX is in BMI2.
   return CRYPTO_is_BMI2_capable() && CRYPTO_is_ADX_capable();
 }
-int bn_mul_mont_nohw(BN_ULONG *rp, const BN_ULONG *ap, const BN_ULONG *bp,
-                     const BN_ULONG *np, const BN_ULONG *n0, size_t num);
+void bn_mul_mont_nohw(BN_ULONG *rp, const BN_ULONG *ap, const BN_ULONG *bp,
+                      const BN_ULONG *np, const BN_ULONG *n0, size_t num);
 inline int bn_mul4x_mont_capable(size_t num) {
   return num >= 8 && (num & 3) == 0;
 }
-int bn_mul4x_mont(BN_ULONG *rp, const BN_ULONG *ap, const BN_ULONG *bp,
-                  const BN_ULONG *np, const BN_ULONG *n0, size_t num);
+void bn_mul4x_mont(BN_ULONG *rp, const BN_ULONG *ap, const BN_ULONG *bp,
+                   const BN_ULONG *np, const BN_ULONG *n0, size_t num);
 inline int bn_mulx4x_mont_capable(size_t num) {
   return bn_mul4x_mont_capable(num) && bn_mulx_adx_capable();
 }
-int bn_mulx4x_mont(BN_ULONG *rp, const BN_ULONG *ap, const BN_ULONG *bp,
-                   const BN_ULONG *np, const BN_ULONG *n0, size_t num);
+void bn_mulx4x_mont(BN_ULONG *rp, const BN_ULONG *ap, const BN_ULONG *bp,
+                    const BN_ULONG *np, const BN_ULONG *n0, size_t num);
 inline int bn_sqr8x_mont_capable(size_t num) {
   return num >= 8 && (num & 7) == 0;
 }
-int bn_sqr8x_mont(BN_ULONG *rp, const BN_ULONG *ap, BN_ULONG mulx_adx_capable,
-                  const BN_ULONG *np, const BN_ULONG *n0, size_t num);
+void bn_sqr8x_mont(BN_ULONG *rp, const BN_ULONG *ap, BN_ULONG mulx_adx_capable,
+                   const BN_ULONG *np, const BN_ULONG *n0, size_t num);
 #elif defined(OPENSSL_ARM)
 inline int bn_mul8x_mont_neon_capable(size_t num) {
   return (num & 7) == 0 && CRYPTO_is_NEON_capable();
 }
-int bn_mul8x_mont_neon(BN_ULONG *rp, const BN_ULONG *ap, const BN_ULONG *bp,
-                       const BN_ULONG *np, const BN_ULONG *n0, size_t num);
-int bn_mul_mont_nohw(BN_ULONG *rp, const BN_ULONG *ap, const BN_ULONG *bp,
-                     const BN_ULONG *np, const BN_ULONG *n0, size_t num);
+void bn_mul8x_mont_neon(BN_ULONG *rp, const BN_ULONG *ap, const BN_ULONG *bp,
+                        const BN_ULONG *np, const BN_ULONG *n0, size_t num);
+void bn_mul_mont_nohw(BN_ULONG *rp, const BN_ULONG *ap, const BN_ULONG *bp,
+                      const BN_ULONG *np, const BN_ULONG *n0, size_t num);
 #endif
 
 #endif  // OPENSSL_BN_ASM_MONT
@@ -721,4 +723,4 @@ void bn_words_to_big_endian(uint8_t *out, size_t out_len, const BN_ULONG *in,
 }  // extern C
 #endif
 
-#endif  // OPENSSL_HEADER_BN_INTERNAL_H
+#endif  // OPENSSL_HEADER_CRYPTO_FIPSMODULE_BN_INTERNAL_H

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/bn/jacobi.cc.inc

@@ -42,32 +42,29 @@ int bn_jacobi(const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx) {
     return -2;
   }
 
-  int ret = -2;
-  BN_CTX_start(ctx);
+  bssl::BN_CTXScope scope(ctx);
   BIGNUM *A = BN_CTX_get(ctx);
   BIGNUM *B = BN_CTX_get(ctx);
   if (B == NULL) {
-    goto end;
+    return -2;
   }
 
   if (!BN_copy(A, a) ||
       !BN_copy(B, b)) {
-    goto end;
+    return -2;
   }
 
   // Adapted from logic to compute the Kronecker symbol, originally implemented
   // according to Henri Cohen, "A Course in Computational Algebraic Number
   // Theory" (algorithm 1.4.10).
 
-  ret = 1;
-
+  int ret = 1;
   while (1) {
     // Cohen's step 3:
 
     // B is positive and odd
     if (BN_is_zero(A)) {
-      ret = BN_is_one(B) ? ret : 0;
-      goto end;
+      return BN_is_one(B) ? ret : 0;
     }
 
     // now A is non-zero
@@ -76,8 +73,7 @@ int bn_jacobi(const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx) {
       i++;
     }
     if (!BN_rshift(A, A, i)) {
-      ret = -2;
-      goto end;
+      return -2;
     }
     if (i & 1) {
       // i is odd
@@ -93,16 +89,11 @@ int bn_jacobi(const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx) {
 
     // (A, B) := (B mod |A|, |A|)
     if (!BN_nnmod(B, B, A, ctx)) {
-      ret = -2;
-      goto end;
+      return -2;
     }
     BIGNUM *tmp = A;
     A = B;
     B = tmp;
     tmp->neg = 0;
   }
-
-end:
-  BN_CTX_end(ctx);
-  return ret;
 }