grpc 1.80.0 → 1.81.0

data/third_party/boringssl-with-bazel/{src/crypto → crypto}/evp/p_ec_asn1.cc

@@ -30,11 +30,11 @@ static int eckey_pub_encode(CBB *out, const EVP_PKEY *key) {
   const EC_POINT *public_key = EC_KEY_get0_public_key(ec_key);
 
   // See RFC 5480, section 2.
-  CBB spki, algorithm, key_bitstring;
+  CBB spki, algorithm, oid, key_bitstring;
   if (!CBB_add_asn1(out, &spki, CBS_ASN1_SEQUENCE) ||
       !CBB_add_asn1(&spki, &algorithm, CBS_ASN1_SEQUENCE) ||
-      !CBB_add_asn1_element(&algorithm, CBS_ASN1_OBJECT, ec_asn1_meth.oid,
-                            ec_asn1_meth.oid_len) ||
+      !CBB_add_asn1(&algorithm, &oid, CBS_ASN1_OBJECT) ||
+      !CBB_add_bytes(&oid, ec_asn1_meth.oid, ec_asn1_meth.oid_len) ||
       !EC_KEY_marshal_curve_name(&algorithm, group) ||
       !CBB_add_asn1(&spki, &key_bitstring, CBS_ASN1_BITSTRING) ||
       !CBB_add_u8(&key_bitstring, 0 /* padding */) ||
@@ -114,12 +114,12 @@ static int eckey_priv_encode(CBB *out, const EVP_PKEY *key) {
   unsigned enc_flags = EC_KEY_get_enc_flags(ec_key) | EC_PKEY_NO_PARAMETERS;
 
   // See RFC 5915.
-  CBB pkcs8, algorithm, private_key;
+  CBB pkcs8, algorithm, oid, private_key;
   if (!CBB_add_asn1(out, &pkcs8, CBS_ASN1_SEQUENCE) ||
       !CBB_add_asn1_uint64(&pkcs8, 0 /* version */) ||
       !CBB_add_asn1(&pkcs8, &algorithm, CBS_ASN1_SEQUENCE) ||
-      !CBB_add_asn1_element(&algorithm, CBS_ASN1_OBJECT, ec_asn1_meth.oid,
-                            ec_asn1_meth.oid_len) ||
+      !CBB_add_asn1(&algorithm, &oid, CBS_ASN1_OBJECT) ||
+      !CBB_add_bytes(&oid, ec_asn1_meth.oid, ec_asn1_meth.oid_len) ||
       !EC_KEY_marshal_curve_name(&algorithm, EC_KEY_get0_group(ec_key)) ||
       !CBB_add_asn1(&pkcs8, &private_key, CBS_ASN1_OCTETSTRING) ||
       !EC_KEY_marshal_private_key(&private_key, ec_key, enc_flags) ||

data/third_party/boringssl-with-bazel/{src/crypto → crypto}/evp/p_ed25519_asn1.cc

@@ -129,11 +129,11 @@ static int ed25519_pub_encode(CBB *out, const EVP_PKEY *pkey) {
   const ED25519_KEY *key = reinterpret_cast<const ED25519_KEY *>(pkey->pkey);
 
   // See RFC 8410, section 4.
-  CBB spki, algorithm, key_bitstring;
+  CBB spki, algorithm, oid, key_bitstring;
   if (!CBB_add_asn1(out, &spki, CBS_ASN1_SEQUENCE) ||
       !CBB_add_asn1(&spki, &algorithm, CBS_ASN1_SEQUENCE) ||
-      !CBB_add_asn1_element(&algorithm, CBS_ASN1_OBJECT, ed25519_asn1_meth.oid,
-                            ed25519_asn1_meth.oid_len) ||
+      !CBB_add_asn1(&algorithm, &oid, CBS_ASN1_OBJECT) ||
+      !CBB_add_bytes(&oid, ed25519_asn1_meth.oid, ed25519_asn1_meth.oid_len) ||
       !CBB_add_asn1(&spki, &key_bitstring, CBS_ASN1_BITSTRING) ||
       !CBB_add_u8(&key_bitstring, 0 /* padding */) ||
       !CBB_add_bytes(&key_bitstring, key->key + ED25519_PUBLIC_KEY_OFFSET,
@@ -176,12 +176,12 @@ static int ed25519_priv_encode(CBB *out, const EVP_PKEY *pkey) {
   }
 
   // See RFC 8410, section 7.
-  CBB pkcs8, algorithm, private_key, inner;
+  CBB pkcs8, algorithm, oid, private_key, inner;
   if (!CBB_add_asn1(out, &pkcs8, CBS_ASN1_SEQUENCE) ||
       !CBB_add_asn1_uint64(&pkcs8, 0 /* version */) ||
       !CBB_add_asn1(&pkcs8, &algorithm, CBS_ASN1_SEQUENCE) ||
-      !CBB_add_asn1_element(&algorithm, CBS_ASN1_OBJECT, ed25519_asn1_meth.oid,
-                            ed25519_asn1_meth.oid_len) ||
+      !CBB_add_asn1(&algorithm, &oid, CBS_ASN1_OBJECT) ||
+      !CBB_add_bytes(&oid, ed25519_asn1_meth.oid, ed25519_asn1_meth.oid_len) ||
       !CBB_add_asn1(&pkcs8, &private_key, CBS_ASN1_OCTETSTRING) ||
       !CBB_add_asn1(&private_key, &inner, CBS_ASN1_OCTETSTRING) ||
       // The PKCS#8 encoding stores only the 32-byte seed which is the first 32

data/third_party/boringssl-with-bazel/{src/crypto → crypto}/evp/p_rsa_asn1.cc

@@ -28,11 +28,11 @@
 static int rsa_pub_encode(CBB *out, const EVP_PKEY *key) {
   // See RFC 3279, section 2.3.1.
   const RSA *rsa = reinterpret_cast<const RSA *>(key->pkey);
-  CBB spki, algorithm, null, key_bitstring;
+  CBB spki, algorithm, oid, null, key_bitstring;
   if (!CBB_add_asn1(out, &spki, CBS_ASN1_SEQUENCE) ||
       !CBB_add_asn1(&spki, &algorithm, CBS_ASN1_SEQUENCE) ||
-      !CBB_add_asn1_element(&algorithm, CBS_ASN1_OBJECT, rsa_asn1_meth.oid,
-                            rsa_asn1_meth.oid_len) ||
+      !CBB_add_asn1(&algorithm, &oid, CBS_ASN1_OBJECT) ||
+      !CBB_add_bytes(&oid, rsa_asn1_meth.oid, rsa_asn1_meth.oid_len) ||
       !CBB_add_asn1(&algorithm, &null, CBS_ASN1_NULL) ||
       !CBB_add_asn1(&spki, &key_bitstring, CBS_ASN1_BITSTRING) ||
       !CBB_add_u8(&key_bitstring, 0 /* padding */) ||
@@ -76,12 +76,12 @@ static int rsa_pub_cmp(const EVP_PKEY *a, const EVP_PKEY *b) {
 
 static int rsa_priv_encode(CBB *out, const EVP_PKEY *key) {
   const RSA *rsa = reinterpret_cast<const RSA *>(key->pkey);
-  CBB pkcs8, algorithm, null, private_key;
+  CBB pkcs8, algorithm, oid, null, private_key;
   if (!CBB_add_asn1(out, &pkcs8, CBS_ASN1_SEQUENCE) ||
       !CBB_add_asn1_uint64(&pkcs8, 0 /* version */) ||
       !CBB_add_asn1(&pkcs8, &algorithm, CBS_ASN1_SEQUENCE) ||
-      !CBB_add_asn1_element(&algorithm, CBS_ASN1_OBJECT, rsa_asn1_meth.oid,
-                            rsa_asn1_meth.oid_len) ||
+      !CBB_add_asn1(&algorithm, &oid, CBS_ASN1_OBJECT) ||
+      !CBB_add_bytes(&oid, rsa_asn1_meth.oid, rsa_asn1_meth.oid_len) ||
       !CBB_add_asn1(&algorithm, &null, CBS_ASN1_NULL) ||
       !CBB_add_asn1(&pkcs8, &private_key, CBS_ASN1_OCTETSTRING) ||
       !RSA_marshal_private_key(&private_key, rsa) ||  //

data/third_party/boringssl-with-bazel/{src/crypto → crypto}/evp/p_x25519_asn1.cc

@@ -143,11 +143,11 @@ static int x25519_pub_encode(CBB *out, const EVP_PKEY *pkey) {
   const X25519_KEY *key = reinterpret_cast<X25519_KEY *>(pkey->pkey);
 
   // See RFC 8410, section 4.
-  CBB spki, algorithm, key_bitstring;
+  CBB spki, algorithm, oid, key_bitstring;
   if (!CBB_add_asn1(out, &spki, CBS_ASN1_SEQUENCE) ||
       !CBB_add_asn1(&spki, &algorithm, CBS_ASN1_SEQUENCE) ||
-      !CBB_add_asn1_element(&algorithm, CBS_ASN1_OBJECT, x25519_asn1_meth.oid,
-                            x25519_asn1_meth.oid_len) ||
+      !CBB_add_asn1(&algorithm, &oid, CBS_ASN1_OBJECT) ||
+      !CBB_add_bytes(&oid, x25519_asn1_meth.oid, x25519_asn1_meth.oid_len) ||
       !CBB_add_asn1(&spki, &key_bitstring, CBS_ASN1_BITSTRING) ||
       !CBB_add_u8(&key_bitstring, 0 /* padding */) ||
       !CBB_add_bytes(&key_bitstring, key->pub, 32) ||  //
@@ -188,12 +188,12 @@ static int x25519_priv_encode(CBB *out, const EVP_PKEY *pkey) {
   }
 
   // See RFC 8410, section 7.
-  CBB pkcs8, algorithm, private_key, inner;
+  CBB pkcs8, algorithm, oid, private_key, inner;
   if (!CBB_add_asn1(out, &pkcs8, CBS_ASN1_SEQUENCE) ||
       !CBB_add_asn1_uint64(&pkcs8, 0 /* version */) ||
       !CBB_add_asn1(&pkcs8, &algorithm, CBS_ASN1_SEQUENCE) ||
-      !CBB_add_asn1_element(&algorithm, CBS_ASN1_OBJECT, x25519_asn1_meth.oid,
-                            x25519_asn1_meth.oid_len) ||
+      !CBB_add_asn1(&algorithm, &oid, CBS_ASN1_OBJECT) ||
+      !CBB_add_bytes(&oid, x25519_asn1_meth.oid, x25519_asn1_meth.oid_len) ||
       !CBB_add_asn1(&pkcs8, &private_key, CBS_ASN1_OCTETSTRING) ||
       !CBB_add_asn1(&private_key, &inner, CBS_ASN1_OCTETSTRING) ||
       // The PKCS#8 encoding stores only the 32-byte seed which is the first 32

data/third_party/boringssl-with-bazel/{src/crypto → crypto}/evp/sign.cc

@@ -36,30 +36,39 @@ int EVP_SignUpdate(EVP_MD_CTX *ctx, const void *data, size_t len) {
 
 int EVP_SignFinal(const EVP_MD_CTX *ctx, uint8_t *sig, unsigned *out_sig_len,
                   EVP_PKEY *pkey) {
-  // Ensure the final result will fit in |unsigned|.
+  uint8_t m[EVP_MAX_MD_SIZE];
+  unsigned m_len;
+  int ret = 0;
+  EVP_MD_CTX tmp_ctx;
+  EVP_PKEY_CTX *pkctx = NULL;
   size_t sig_len = EVP_PKEY_size(pkey);
+
+  // Ensure the final result will fit in |unsigned|.
   if (sig_len > UINT_MAX) {
     sig_len = UINT_MAX;
   }
 
   *out_sig_len = 0;
-  uint8_t m[EVP_MAX_MD_SIZE];
-  unsigned m_len;
-  bssl::ScopedEVP_MD_CTX tmp_ctx;
-  if (!EVP_MD_CTX_copy_ex(tmp_ctx.get(), ctx) ||
-      !EVP_DigestFinal_ex(tmp_ctx.get(), m, &m_len)) {
-    return 0;
+  EVP_MD_CTX_init(&tmp_ctx);
+  if (!EVP_MD_CTX_copy_ex(&tmp_ctx, ctx) ||
+      !EVP_DigestFinal_ex(&tmp_ctx, m, &m_len)) {
+    goto out;
   }
+  EVP_MD_CTX_cleanup(&tmp_ctx);
 
-  bssl::UniquePtr<EVP_PKEY_CTX> pkctx(EVP_PKEY_CTX_new(pkey, nullptr));
+  pkctx = EVP_PKEY_CTX_new(pkey, NULL);
   if (!pkctx ||  //
-      !EVP_PKEY_sign_init(pkctx.get()) ||
-      !EVP_PKEY_CTX_set_signature_md(pkctx.get(), ctx->digest) ||
-      !EVP_PKEY_sign(pkctx.get(), sig, &sig_len, m, m_len)) {
-    return 0;
+      !EVP_PKEY_sign_init(pkctx) ||
+      !EVP_PKEY_CTX_set_signature_md(pkctx, ctx->digest) ||
+      !EVP_PKEY_sign(pkctx, sig, &sig_len, m, m_len)) {
+    goto out;
   }
-  *out_sig_len = static_cast<unsigned>(sig_len);
-  return 1;
+  *out_sig_len = (unsigned)sig_len;
+  ret = 1;
+
+out:
+  EVP_PKEY_CTX_free(pkctx);
+  return ret;
 }
 
 int EVP_VerifyInit_ex(EVP_MD_CTX *ctx, const EVP_MD *type, ENGINE *impl) {
@@ -78,18 +87,28 @@ int EVP_VerifyFinal(EVP_MD_CTX *ctx, const uint8_t *sig, size_t sig_len,
                     EVP_PKEY *pkey) {
   uint8_t m[EVP_MAX_MD_SIZE];
   unsigned m_len;
-  bssl::ScopedEVP_MD_CTX tmp_ctx;
-  if (!EVP_MD_CTX_copy_ex(tmp_ctx.get(), ctx) ||
-      !EVP_DigestFinal_ex(tmp_ctx.get(), m, &m_len)) {
-    return 0;
+  int ret = 0;
+  EVP_MD_CTX tmp_ctx;
+  EVP_PKEY_CTX *pkctx = NULL;
+
+  EVP_MD_CTX_init(&tmp_ctx);
+  if (!EVP_MD_CTX_copy_ex(&tmp_ctx, ctx) ||
+      !EVP_DigestFinal_ex(&tmp_ctx, m, &m_len)) {
+    EVP_MD_CTX_cleanup(&tmp_ctx);
+    goto out;
   }
+  EVP_MD_CTX_cleanup(&tmp_ctx);
 
-  bssl::UniquePtr<EVP_PKEY_CTX> pkctx(EVP_PKEY_CTX_new(pkey, nullptr));
+  pkctx = EVP_PKEY_CTX_new(pkey, NULL);
   if (!pkctx ||
-      !EVP_PKEY_verify_init(pkctx.get()) ||
-      !EVP_PKEY_CTX_set_signature_md(pkctx.get(), ctx->digest)) {
-    return 0;
+      !EVP_PKEY_verify_init(pkctx) ||
+      !EVP_PKEY_CTX_set_signature_md(pkctx, ctx->digest)) {
+    goto out;
   }
-  return EVP_PKEY_verify(pkctx.get(), sig, sig_len, m, m_len);
+  ret = EVP_PKEY_verify(pkctx, sig, sig_len, m, m_len);
+
+out:
+  EVP_PKEY_CTX_free(pkctx);
+  return ret;
 }
 

data/third_party/boringssl-with-bazel/{src/crypto → crypto}/fipsmodule/bn/div.cc.inc

@@ -732,3 +732,82 @@ BN_ULONG BN_mod_word(const BIGNUM *a, BN_ULONG w) {
   }
   return (BN_ULONG)ret;
 }
+
+int BN_mod_pow2(BIGNUM *r, const BIGNUM *a, size_t e) {
+  if (e == 0 || a->width == 0) {
+    BN_zero(r);
+    return 1;
+  }
+
+  size_t num_words = 1 + ((e - 1) / BN_BITS2);
+
+  // If |a| definitely has less than |e| bits, just BN_copy.
+  if ((size_t)a->width < num_words) {
+    return BN_copy(r, a) != NULL;
+  }
+
+  // Otherwise, first make sure we have enough space in |r|.
+  // Note that this will fail if num_words > INT_MAX.
+  if (!bn_wexpand(r, num_words)) {
+    return 0;
+  }
+
+  // Copy the content of |a| into |r|.
+  OPENSSL_memcpy(r->d, a->d, num_words * sizeof(BN_ULONG));
+
+  // If |e| isn't word-aligned, we have to mask off some of our bits.
+  size_t top_word_exponent = e % (sizeof(BN_ULONG) * 8);
+  if (top_word_exponent != 0) {
+    r->d[num_words - 1] &= (((BN_ULONG)1) << top_word_exponent) - 1;
+  }
+
+  // Fill in the remaining fields of |r|.
+  r->neg = a->neg;
+  r->width = (int)num_words;
+  bn_set_minimal_width(r);
+  return 1;
+}
+
+int BN_nnmod_pow2(BIGNUM *r, const BIGNUM *a, size_t e) {
+  if (!BN_mod_pow2(r, a, e)) {
+    return 0;
+  }
+
+  // If the returned value was non-negative, we're done.
+  if (BN_is_zero(r) || !r->neg) {
+    return 1;
+  }
+
+  size_t num_words = 1 + (e - 1) / BN_BITS2;
+
+  // Expand |r| to the size of our modulus.
+  if (!bn_wexpand(r, num_words)) {
+    return 0;
+  }
+
+  // Clear the upper words of |r|.
+  OPENSSL_memset(&r->d[r->width], 0, (num_words - r->width) * BN_BYTES);
+
+  // Set parameters of |r|.
+  r->neg = 0;
+  r->width = (int)num_words;
+
+  // Now, invert every word. The idea here is that we want to compute 2^e-|x|,
+  // which is actually equivalent to the twos-complement representation of |x|
+  // in |e| bits, which is -x = ~x + 1.
+  for (int i = 0; i < r->width; i++) {
+    r->d[i] = ~r->d[i];
+  }
+
+  // If our exponent doesn't span the top word, we have to mask the rest.
+  size_t top_word_exponent = e % BN_BITS2;
+  if (top_word_exponent != 0) {
+    r->d[r->width - 1] &= (((BN_ULONG)1) << top_word_exponent) - 1;
+  }
+
+  // Keep the minimal-width invariant for |BIGNUM|.
+  bn_set_minimal_width(r);
+
+  // Finally, add one, for the reason described above.
+  return BN_add(r, r, BN_value_one());
+}

data/third_party/boringssl-with-bazel/{src/crypto → crypto}/fipsmodule/bn/exponentiation.cc.inc

@@ -413,6 +413,7 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
                               const BIGNUM *m, BN_CTX *ctx,
                               const BN_MONT_CTX *mont) {
   int i, ret = 0, wvalue;
+  BN_MONT_CTX *new_mont = NULL;
 
   void *powerbuf_free = NULL;
   size_t powerbuf_len = 0;
@@ -448,13 +449,12 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
 
   // Allocate a montgomery context if it was not supplied by the caller.
   int top, num_powers, window;
-  bssl::UniquePtr<BN_MONT_CTX> new_mont;
-  if (mont == nullptr) {
-    new_mont.reset(BN_MONT_CTX_new_consttime(m, ctx));
-    if (new_mont == nullptr) {
+  if (mont == NULL) {
+    new_mont = BN_MONT_CTX_new_consttime(m, ctx);
+    if (new_mont == NULL) {
       goto err;
     }
-    mont = new_mont.get();
+    mont = new_mont;
   }
 
   // Use the width in |mont->N|, rather than the copy in |m|. The assembly
@@ -731,6 +731,7 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
   ret = 1;
 
 err:
+  BN_MONT_CTX_free(new_mont);
   if (powerbuf != NULL && powerbuf_free == NULL) {
     OPENSSL_cleanse(powerbuf, powerbuf_len);
   }

data/third_party/boringssl-with-bazel/{src/crypto → crypto}/fipsmodule/bn/gcd.cc.inc

@@ -33,20 +33,23 @@ int BN_mod_inverse_odd(BIGNUM *out, int *out_no_inverse, const BIGNUM *a,
     return 0;
   }
 
+  BIGNUM *A, *B, *X, *Y;
+  int ret = 0;
   int sign;
-  bssl::BN_CTXScope scope(ctx);
-  BIGNUM *A = BN_CTX_get(ctx);
-  BIGNUM *B = BN_CTX_get(ctx);
-  BIGNUM *X = BN_CTX_get(ctx);
-  BIGNUM *Y = BN_CTX_get(ctx);
+
+  BN_CTX_start(ctx);
+  A = BN_CTX_get(ctx);
+  B = BN_CTX_get(ctx);
+  X = BN_CTX_get(ctx);
+  Y = BN_CTX_get(ctx);
   BIGNUM *R = out;
   if (Y == NULL) {
-    return 0;
+    goto err;
   }
 
   BN_zero(Y);
   if (!BN_one(X) || BN_copy(B, a) == NULL || BN_copy(A, n) == NULL) {
-    return 0;
+    goto err;
   }
   A->neg = 0;
   sign = -1;
@@ -77,17 +80,17 @@ int BN_mod_inverse_odd(BIGNUM *out, int *out_no_inverse, const BIGNUM *a,
 
       if (BN_is_odd(X)) {
         if (!BN_uadd(X, X, n)) {
-          return 0;
+          goto err;
         }
       }
       // now X is even, so we can easily divide it by two
       if (!BN_rshift1(X, X)) {
-        return 0;
+        goto err;
       }
     }
     if (shift > 0) {
       if (!BN_rshift(B, B, shift)) {
-        return 0;
+        goto err;
       }
     }
 
@@ -99,17 +102,17 @@ int BN_mod_inverse_odd(BIGNUM *out, int *out_no_inverse, const BIGNUM *a,
 
       if (BN_is_odd(Y)) {
         if (!BN_uadd(Y, Y, n)) {
-          return 0;
+          goto err;
         }
       }
       // now Y is even
       if (!BN_rshift1(Y, Y)) {
-        return 0;
+        goto err;
       }
     }
     if (shift > 0) {
       if (!BN_rshift(A, A, shift)) {
-        return 0;
+        goto err;
       }
     }
 
@@ -126,21 +129,21 @@ int BN_mod_inverse_odd(BIGNUM *out, int *out_no_inverse, const BIGNUM *a,
     if (BN_ucmp(B, A) >= 0) {
       // -sign*(X + Y)*a == B - A  (mod |n|)
       if (!BN_uadd(X, X, Y)) {
-        return 0;
+        goto err;
       }
       // NB: we could use BN_mod_add_quick(X, X, Y, n), but that
       // actually makes the algorithm slower
       if (!BN_usub(B, B, A)) {
-        return 0;
+        goto err;
       }
     } else {
       //  sign*(X + Y)*a == A - B  (mod |n|)
       if (!BN_uadd(Y, Y, X)) {
-        return 0;
+        goto err;
       }
       // as above, BN_mod_add_quick(Y, Y, X, n) would slow things down
       if (!BN_usub(A, A, B)) {
-        return 0;
+        goto err;
       }
     }
   }
@@ -148,7 +151,7 @@ int BN_mod_inverse_odd(BIGNUM *out, int *out_no_inverse, const BIGNUM *a,
   if (!BN_is_one(A)) {
     *out_no_inverse = 1;
     OPENSSL_PUT_ERROR(BN, BN_R_NO_INVERSE);
-    return 0;
+    goto err;
   }
 
   // The while loop (Euclid's algorithm) ends when
@@ -159,7 +162,7 @@ int BN_mod_inverse_odd(BIGNUM *out, int *out_no_inverse, const BIGNUM *a,
 
   if (sign < 0) {
     if (!BN_sub(Y, n, Y)) {
-      return 0;
+      goto err;
     }
   }
   // Now  Y*a  ==  A  (mod |n|).
@@ -167,49 +170,61 @@ int BN_mod_inverse_odd(BIGNUM *out, int *out_no_inverse, const BIGNUM *a,
   // Y*a == 1  (mod |n|)
   if (Y->neg || BN_ucmp(Y, n) >= 0) {
     if (!BN_nnmod(Y, Y, n, ctx)) {
-      return 0;
+      goto err;
     }
   }
   if (!BN_copy(R, Y)) {
-    return 0;
+    goto err;
   }
 
-  return 1;
+  ret = 1;
+
+err:
+  BN_CTX_end(ctx);
+  return ret;
 }
 
 BIGNUM *BN_mod_inverse(BIGNUM *out, const BIGNUM *a, const BIGNUM *n,
                        BN_CTX *ctx) {
-  bssl::UniquePtr<BIGNUM> new_out;
-  if (out == nullptr) {
-    new_out.reset(BN_new());
-    if (new_out == nullptr) {
-      return nullptr;
+  BIGNUM *new_out = NULL;
+  if (out == NULL) {
+    new_out = BN_new();
+    if (new_out == NULL) {
+      return NULL;
     }
-    out = new_out.get();
+    out = new_out;
   }
 
-  bssl::UniquePtr<BIGNUM> a_reduced;
+  int ok = 0;
+  BIGNUM *a_reduced = NULL;
   if (a->neg || BN_ucmp(a, n) >= 0) {
-    a_reduced.reset(BN_dup(a));
-    if (a_reduced == nullptr) {
-      return nullptr;
+    a_reduced = BN_dup(a);
+    if (a_reduced == NULL) {
+      goto err;
     }
-    if (!BN_nnmod(a_reduced.get(), a_reduced.get(), n, ctx)) {
-      return nullptr;
+    if (!BN_nnmod(a_reduced, a_reduced, n, ctx)) {
+      goto err;
     }
-    a = a_reduced.get();
+    a = a_reduced;
   }
 
   int no_inverse;
   if (!BN_is_odd(n)) {
     if (!bn_mod_inverse_consttime(out, &no_inverse, a, n, ctx)) {
-      return nullptr;
+      goto err;
     }
   } else if (!BN_mod_inverse_odd(out, &no_inverse, a, n, ctx)) {
-    return nullptr;
+    goto err;
   }
 
-  new_out.release();  // Passed to the caller via |out|.
+  ok = 1;
+
+err:
+  if (!ok) {
+    BN_free(new_out);
+    out = NULL;
+  }
+  BN_free(a_reduced);
   return out;
 }
 
@@ -225,10 +240,9 @@ int BN_mod_inverse_blinded(BIGNUM *out, int *out_no_inverse, const BIGNUM *a,
     return 0;
   }
 
-  bssl::UniquePtr<BIGNUM> blinding_factor(BN_new());
-  if (blinding_factor == nullptr) {
-    return 0;
-  }
+  int ret = 0;
+  BIGNUM blinding_factor;
+  BN_init(&blinding_factor);
 
   // |BN_mod_inverse_odd| is leaky, so generate a secret blinding factor and
   // blind |a|. This works because (ar)^-1 * r = a^-1, supposing r is
@@ -239,12 +253,12 @@ int BN_mod_inverse_blinded(BIGNUM *out, int *out_no_inverse, const BIGNUM *a,
   //
   // TODO(crbug.com/boringssl/677): When the PRNG output is marked secret by
   // default, the explicit |bn_secret| call can be removed.
-  if (!BN_rand_range_ex(blinding_factor.get(), 1, &mont->N)) {
-    return 0;
+  if (!BN_rand_range_ex(&blinding_factor, 1, &mont->N)) {
+    goto err;
   }
-  bn_secret(blinding_factor.get());
-  if (!BN_mod_mul_montgomery(out, blinding_factor.get(), a, mont, ctx)) {
-    return 0;
+  bn_secret(&blinding_factor);
+  if (!BN_mod_mul_montgomery(out, &blinding_factor, a, mont, ctx)) {
+    goto err;
   }
 
   // Once blinded, |out| is no longer secret, so it may be passed to a leaky
@@ -252,27 +266,35 @@ int BN_mod_inverse_blinded(BIGNUM *out, int *out_no_inverse, const BIGNUM *a,
   // secret again after multiplying.
   bn_declassify(out);
   if (!BN_mod_inverse_odd(out, out_no_inverse, out, &mont->N, ctx) ||
-      !BN_mod_mul_montgomery(out, blinding_factor.get(), out, mont, ctx)) {
-    return 0;
+      !BN_mod_mul_montgomery(out, &blinding_factor, out, mont, ctx)) {
+    goto err;
   }
 
-  return 1;
+  ret = 1;
+
+err:
+  BN_free(&blinding_factor);
+  return ret;
 }
 
 int bn_mod_inverse_prime(BIGNUM *out, const BIGNUM *a, const BIGNUM *p,
                          BN_CTX *ctx, const BN_MONT_CTX *mont_p) {
-  bssl::BN_CTXScope scope(ctx);
+  BN_CTX_start(ctx);
   BIGNUM *p_minus_2 = BN_CTX_get(ctx);
-  return p_minus_2 != nullptr && BN_copy(p_minus_2, p) &&
-         BN_sub_word(p_minus_2, 2) &&
-         BN_mod_exp_mont(out, a, p_minus_2, p, ctx, mont_p);
+  int ok = p_minus_2 != NULL && BN_copy(p_minus_2, p) &&
+           BN_sub_word(p_minus_2, 2) &&
+           BN_mod_exp_mont(out, a, p_minus_2, p, ctx, mont_p);
+  BN_CTX_end(ctx);
+  return ok;
 }
 
 int bn_mod_inverse_secret_prime(BIGNUM *out, const BIGNUM *a, const BIGNUM *p,
                                 BN_CTX *ctx, const BN_MONT_CTX *mont_p) {
-  bssl::BN_CTXScope scope(ctx);
+  BN_CTX_start(ctx);
   BIGNUM *p_minus_2 = BN_CTX_get(ctx);
-  return p_minus_2 != nullptr && BN_copy(p_minus_2, p) &&
-         BN_sub_word(p_minus_2, 2) &&
-         BN_mod_exp_mont_consttime(out, a, p_minus_2, p, ctx, mont_p);
+  int ok = p_minus_2 != NULL && BN_copy(p_minus_2, p) &&
+           BN_sub_word(p_minus_2, 2) &&
+           BN_mod_exp_mont_consttime(out, a, p_minus_2, p, ctx, mont_p);
+  BN_CTX_end(ctx);
+  return ok;
 }