grpc 1.80.0 → 1.81.0

data/third_party/boringssl-with-bazel/{src/crypto → crypto}/fipsmodule/dh/check.cc.inc

@@ -55,11 +55,13 @@ int DH_check_pub_key(const DH *dh, const BIGNUM *pub_key, int *out_flags) {
     return 0;
   }
 
-  bssl::UniquePtr<BN_CTX> ctx(BN_CTX_new());
+  BN_CTX *ctx = BN_CTX_new();
   if (ctx == NULL) {
     return 0;
   }
-  bssl::BN_CTXScope scope(ctx.get());
+  BN_CTX_start(ctx);
+
+  int ok = 0;
 
   // Check |pub_key| is greater than 1.
   if (BN_cmp(pub_key, BN_value_one()) <= 0) {
@@ -67,11 +69,11 @@ int DH_check_pub_key(const DH *dh, const BIGNUM *pub_key, int *out_flags) {
   }
 
   // Check |pub_key| is less than |dh->p| - 1.
-  BIGNUM *tmp = BN_CTX_get(ctx.get());
+  BIGNUM *tmp = BN_CTX_get(ctx);
   if (tmp == NULL ||
       !BN_copy(tmp, dh->p) ||
       !BN_sub_word(tmp, 1)) {
-    return 0;
+    goto err;
   }
   if (BN_cmp(pub_key, tmp) >= 0) {
     *out_flags |= DH_CHECK_PUBKEY_TOO_LARGE;
@@ -81,17 +83,23 @@ int DH_check_pub_key(const DH *dh, const BIGNUM *pub_key, int *out_flags) {
     // Check |pub_key|^|dh->q| is 1 mod |dh->p|. This is necessary for RFC 5114
     // groups which are not safe primes but pick a generator on a prime-order
     // subgroup of size |dh->q|.
-    if (!BN_mod_exp_mont(tmp, pub_key, dh->q, dh->p, ctx.get(), NULL)) {
-      return 0;
+    if (!BN_mod_exp_mont(tmp, pub_key, dh->q, dh->p, ctx, NULL)) {
+      goto err;
     }
     if (!BN_is_one(tmp)) {
       *out_flags |= DH_CHECK_PUBKEY_INVALID;
     }
   }
 
-  return 1;
+  ok = 1;
+
+err:
+  BN_CTX_end(ctx);
+  BN_CTX_free(ctx);
+  return ok;
 }
 
+
 int DH_check(const DH *dh, int *out_flags) {
   *out_flags = 0;
   if (!dh_check_params_fast(dh)) {
@@ -104,18 +112,23 @@ int DH_check(const DH *dh, int *out_flags) {
   //   for 3, p mod 12 == 5
   //   for 5, p mod 10 == 3 or 7
   // should hold.
-  bssl::UniquePtr<BN_CTX> ctx(BN_CTX_new());
-  if (ctx == nullptr) {
-    return 0;
+  int ok = 0, r;
+  BN_CTX *ctx = NULL;
+  BN_ULONG l;
+  BIGNUM *t1 = NULL, *t2 = NULL;
+
+  ctx = BN_CTX_new();
+  if (ctx == NULL) {
+    goto err;
   }
-  bssl::BN_CTXScope scope(ctx.get());
-  BIGNUM *t1 = BN_CTX_get(ctx.get());
-  if (t1 == nullptr) {
-    return 0;
+  BN_CTX_start(ctx);
+  t1 = BN_CTX_get(ctx);
+  if (t1 == NULL) {
+    goto err;
   }
-  BIGNUM *t2 = BN_CTX_get(ctx.get());
-  if (t2 == nullptr) {
-    return 0;
+  t2 = BN_CTX_get(ctx);
+  if (t2 == NULL) {
+    goto err;
   }
 
   if (dh->q) {
@@ -125,40 +138,39 @@ int DH_check(const DH *dh, int *out_flags) {
       *out_flags |= DH_CHECK_NOT_SUITABLE_GENERATOR;
     } else {
       // Check g^q == 1 mod p
-      if (!BN_mod_exp_mont(t1, dh->g, dh->q, dh->p, ctx.get(), nullptr)) {
-        return 0;
+      if (!BN_mod_exp_mont(t1, dh->g, dh->q, dh->p, ctx, NULL)) {
+        goto err;
       }
       if (!BN_is_one(t1)) {
         *out_flags |= DH_CHECK_NOT_SUITABLE_GENERATOR;
       }
     }
-    int r = BN_is_prime_ex(dh->q, BN_prime_checks_for_validation, ctx.get(),
-                           nullptr);
+    r = BN_is_prime_ex(dh->q, BN_prime_checks_for_validation, ctx, NULL);
     if (r < 0) {
-      return 0;
+      goto err;
     }
     if (!r) {
       *out_flags |= DH_CHECK_Q_NOT_PRIME;
     }
     // Check p == 1 mod q  i.e. q divides p - 1
-    if (!BN_div(t1, t2, dh->p, dh->q, ctx.get())) {
-      return 0;
+    if (!BN_div(t1, t2, dh->p, dh->q, ctx)) {
+      goto err;
     }
     if (!BN_is_one(t2)) {
       *out_flags |= DH_CHECK_INVALID_Q_VALUE;
     }
   } else if (BN_is_word(dh->g, DH_GENERATOR_2)) {
-    BN_ULONG l = BN_mod_word(dh->p, 24);
+    l = BN_mod_word(dh->p, 24);
     if (l == (BN_ULONG)-1) {
-      return 0;
+      goto err;
     }
     if (l != 11) {
       *out_flags |= DH_CHECK_NOT_SUITABLE_GENERATOR;
     }
   } else if (BN_is_word(dh->g, DH_GENERATOR_5)) {
-    BN_ULONG l = BN_mod_word(dh->p, 10);
+    l = BN_mod_word(dh->p, 10);
     if (l == (BN_ULONG)-1) {
-      return 0;
+      goto err;
     }
     if (l != 3 && l != 7) {
       *out_flags |= DH_CHECK_NOT_SUITABLE_GENERATOR;
@@ -167,24 +179,30 @@ int DH_check(const DH *dh, int *out_flags) {
     *out_flags |= DH_CHECK_UNABLE_TO_CHECK_GENERATOR;
   }
 
-  int r =
-      BN_is_prime_ex(dh->p, BN_prime_checks_for_validation, ctx.get(), nullptr);
+  r = BN_is_prime_ex(dh->p, BN_prime_checks_for_validation, ctx, NULL);
   if (r < 0) {
-    return 0;
+    goto err;
   }
   if (!r) {
     *out_flags |= DH_CHECK_P_NOT_PRIME;
   } else if (!dh->q) {
     if (!BN_rshift1(t1, dh->p)) {
-      return 0;
+      goto err;
     }
-    r = BN_is_prime_ex(t1, BN_prime_checks_for_validation, ctx.get(), nullptr);
+    r = BN_is_prime_ex(t1, BN_prime_checks_for_validation, ctx, NULL);
     if (r < 0) {
-      return 0;
+      goto err;
     }
     if (!r) {
       *out_flags |= DH_CHECK_P_NOT_SAFE_PRIME;
     }
   }
-  return 1;
+  ok = 1;
+
+err:
+  if (ctx != NULL) {
+    BN_CTX_end(ctx);
+    BN_CTX_free(ctx);
+  }
+  return ok;
 }

data/third_party/boringssl-with-bazel/{src/crypto → crypto}/fipsmodule/dh/dh.cc.inc

@@ -147,27 +147,28 @@ int DH_generate_key(DH *dh) {
   }
 
   int ok = 0;
-  bool generate_new_key = false;
-  BIGNUM *pub_key = nullptr, *priv_key = nullptr;
+  int generate_new_key = 0;
+  BN_CTX *ctx = NULL;
+  BIGNUM *pub_key = NULL, *priv_key = NULL, *priv_key_limit = NULL;
 
-  bssl::UniquePtr<BN_CTX> ctx(BN_CTX_new());
-  if (ctx == nullptr) {
+  ctx = BN_CTX_new();
+  if (ctx == NULL) {
     goto err;
   }
 
-  if (dh->priv_key == nullptr) {
+  if (dh->priv_key == NULL) {
     priv_key = BN_new();
-    if (priv_key == nullptr) {
+    if (priv_key == NULL) {
       goto err;
     }
-    generate_new_key = true;
+    generate_new_key = 1;
   } else {
     priv_key = dh->priv_key;
   }
 
-  if (dh->pub_key == nullptr) {
+  if (dh->pub_key == NULL) {
     pub_key = BN_new();
-    if (pub_key == nullptr) {
+    if (pub_key == NULL) {
       goto err;
     }
   } else {
@@ -175,7 +176,7 @@ int DH_generate_key(DH *dh) {
   }
 
   if (!BN_MONT_CTX_set_locked(&dh->method_mont_p, &dh->method_mont_p_lock,
-                              dh->p, ctx.get())) {
+                              dh->p, ctx)) {
     goto err;
   }
 
@@ -201,30 +202,30 @@ int DH_generate_key(DH *dh) {
       // clamp |dh->priv_length| before invoking the algorithm.
 
       // Compute M = min(2^N, q).
-      bssl::UniquePtr<BIGNUM> priv_key_limit(BN_new());
-      if (priv_key_limit == nullptr) {
+      priv_key_limit = BN_new();
+      if (priv_key_limit == NULL) {
         goto err;
       }
       if (dh->priv_length == 0 || dh->priv_length >= BN_num_bits(dh->p) - 1) {
         // M = q = (p - 1) / 2.
-        if (!BN_rshift1(priv_key_limit.get(), dh->p)) {
+        if (!BN_rshift1(priv_key_limit, dh->p)) {
           goto err;
         }
       } else {
         // M = 2^N.
-        if (!BN_set_bit(priv_key_limit.get(), dh->priv_length)) {
+        if (!BN_set_bit(priv_key_limit, dh->priv_length)) {
           goto err;
         }
       }
 
       // Choose a private key uniformly from [1, M-1].
-      if (!BN_rand_range_ex(priv_key, 1, priv_key_limit.get())) {
+      if (!BN_rand_range_ex(priv_key, 1, priv_key_limit)) {
         goto err;
       }
     }
   }
 
-  if (!BN_mod_exp_mont_consttime(pub_key, dh->g, priv_key, dh->p, ctx.get(),
+  if (!BN_mod_exp_mont_consttime(pub_key, dh->g, priv_key, dh->p, ctx,
                                  dh->method_mont_p)) {
     goto err;
   }
@@ -238,12 +239,14 @@ err:
     OPENSSL_PUT_ERROR(DH, ERR_R_BN_LIB);
   }
 
-  if (dh->pub_key == nullptr) {
+  if (dh->pub_key == NULL) {
     BN_free(pub_key);
   }
-  if (dh->priv_key == nullptr) {
+  if (dh->priv_key == NULL) {
     BN_free(priv_key);
   }
+  BN_free(priv_key_limit);
+  BN_CTX_free(ctx);
   return ok;
 }
 
@@ -264,46 +267,56 @@ static int dh_compute_key(DH *dh, BIGNUM *out_shared_key,
     return 0;
   }
 
-  bssl::BN_CTXScope scope(ctx);
+  int ret = 0;
+  BN_CTX_start(ctx);
   BIGNUM *p_minus_1 = BN_CTX_get(ctx);
+
   if (!p_minus_1 ||
       !BN_MONT_CTX_set_locked(&dh->method_mont_p, &dh->method_mont_p_lock,
                               dh->p, ctx)) {
-    return 0;
+    goto err;
   }
 
   if (!BN_mod_exp_mont_consttime(out_shared_key, peers_key, dh->priv_key, dh->p,
                                  ctx, dh->method_mont_p) ||
       !BN_copy(p_minus_1, dh->p) || !BN_sub_word(p_minus_1, 1)) {
     OPENSSL_PUT_ERROR(DH, ERR_R_BN_LIB);
-    return 0;
+    goto err;
   }
 
   // This performs the check required by SP 800-56Ar3 section 5.7.1.1 step two.
   if (BN_cmp_word(out_shared_key, 1) <= 0 ||
       BN_cmp(out_shared_key, p_minus_1) == 0) {
     OPENSSL_PUT_ERROR(DH, DH_R_INVALID_PUBKEY);
-    return 0;
+    goto err;
   }
 
-  return 1;
+  ret = 1;
+
+err:
+  BN_CTX_end(ctx);
+  return ret;
 }
 
 int dh_compute_key_padded_no_self_test(unsigned char *out,
                                        const BIGNUM *peers_key, DH *dh) {
-  bssl::UniquePtr<BN_CTX> ctx(BN_CTX_new());
-  if (ctx == nullptr) {
+  BN_CTX *ctx = BN_CTX_new();
+  if (ctx == NULL) {
     return -1;
   }
-  bssl::BN_CTXScope scope(ctx.get());
+  BN_CTX_start(ctx);
+
   int dh_size = DH_size(dh);
-  BIGNUM *shared_key = BN_CTX_get(ctx.get());
-  if (shared_key == nullptr ||
-      !dh_compute_key(dh, shared_key, peers_key, ctx.get()) ||
-      !BN_bn2bin_padded(out, dh_size, shared_key)) {
-    return -1;
+  int ret = -1;
+  BIGNUM *shared_key = BN_CTX_get(ctx);
+  if (shared_key && dh_compute_key(dh, shared_key, peers_key, ctx) &&
+      BN_bn2bin_padded(out, dh_size, shared_key)) {
+    ret = dh_size;
   }
-  return dh_size;
+
+  BN_CTX_end(ctx);
+  BN_CTX_free(ctx);
+  return ret;
 }
 
 int DH_compute_key_padded(unsigned char *out, const BIGNUM *peers_key, DH *dh) {
@@ -315,18 +328,22 @@ int DH_compute_key_padded(unsigned char *out, const BIGNUM *peers_key, DH *dh) {
 int DH_compute_key(unsigned char *out, const BIGNUM *peers_key, DH *dh) {
   boringssl_ensure_ffdh_self_test();
 
-  bssl::UniquePtr<BN_CTX> ctx(BN_CTX_new());
-  if (ctx == nullptr) {
+  BN_CTX *ctx = BN_CTX_new();
+  if (ctx == NULL) {
     return -1;
   }
-  bssl::BN_CTXScope scope(ctx.get());
-  BIGNUM *shared_key = BN_CTX_get(ctx.get());
-  if (shared_key == nullptr ||
-      !dh_compute_key(dh, shared_key, peers_key, ctx.get())) {
-    return -1;
+  BN_CTX_start(ctx);
+
+  int ret = -1;
+  BIGNUM *shared_key = BN_CTX_get(ctx);
+  if (shared_key && dh_compute_key(dh, shared_key, peers_key, ctx)) {
+    // A |BIGNUM|'s byte count fits in |int|.
+    ret = (int)BN_bn2bin(shared_key, out);
   }
-  // A |BIGNUM|'s byte count fits in |int|.
-  return static_cast<int>(BN_bn2bin(shared_key, out));
+
+  BN_CTX_end(ctx);
+  BN_CTX_free(ctx);
+  return ret;
 }
 
 int DH_compute_key_hashed(DH *dh, uint8_t *out, size_t *out_len,
@@ -398,27 +415,29 @@ DH *DH_get_rfc7919_2048(void) {
       TOBN(0xadf85458, 0xa2bb4a9a), TOBN(0xffffffff, 0xffffffff),
   };
 
-  bssl::UniquePtr<BIGNUM> ffdhe2048_p(BN_new());
-  bssl::UniquePtr<BIGNUM> ffdhe2048_q(BN_new());
-  bssl::UniquePtr<BIGNUM> ffdhe2048_g(BN_new());
-  bssl::UniquePtr<DH> dh(DH_new());
+  BIGNUM *const ffdhe2048_p = BN_new();
+  BIGNUM *const ffdhe2048_q = BN_new();
+  BIGNUM *const ffdhe2048_g = BN_new();
+  DH *const dh = DH_new();
+
   if (!ffdhe2048_p || !ffdhe2048_q || !ffdhe2048_g || !dh) {
-    return nullptr;
+    goto err;
   }
 
-  bn_set_static_words(ffdhe2048_p.get(), kFFDHE2048Data,
+  bn_set_static_words(ffdhe2048_p, kFFDHE2048Data,
                       OPENSSL_ARRAY_SIZE(kFFDHE2048Data));
 
-  if (!BN_rshift1(ffdhe2048_q.get(), ffdhe2048_p.get()) ||
-      !BN_set_word(ffdhe2048_g.get(), 2) ||
-      !DH_set0_pqg(dh.get(), ffdhe2048_p.get(), ffdhe2048_q.get(),
-                   ffdhe2048_g.get())) {
-    return nullptr;
+  if (!BN_rshift1(ffdhe2048_q, ffdhe2048_p) || !BN_set_word(ffdhe2048_g, 2) ||
+      !DH_set0_pqg(dh, ffdhe2048_p, ffdhe2048_q, ffdhe2048_g)) {
+    goto err;
   }
-  // |DH_set0_pqg| takes ownership on success.
-  ffdhe2048_p.release();
-  ffdhe2048_q.release();
-  ffdhe2048_g.release();
 
-  return dh.release();
+  return dh;
+
+err:
+  BN_free(ffdhe2048_p);
+  BN_free(ffdhe2048_q);
+  BN_free(ffdhe2048_g);
+  DH_free(dh);
+  return NULL;
 }

data/third_party/boringssl-with-bazel/{src/crypto → crypto}/fipsmodule/digest/digest.cc.inc

@@ -212,10 +212,16 @@ int EVP_DigestFinal(EVP_MD_CTX *ctx, uint8_t *md, unsigned int *size) {
 
 int EVP_Digest(const void *data, size_t count, uint8_t *out_md,
                unsigned int *out_size, const EVP_MD *type, ENGINE *impl) {
-  bssl::ScopedEVP_MD_CTX ctx;
-  return EVP_DigestInit_ex(ctx.get(), type, impl) &&
-         EVP_DigestUpdate(ctx.get(), data, count) &&
-         EVP_DigestFinal_ex(ctx.get(), out_md, out_size);
+  EVP_MD_CTX ctx;
+  int ret;
+
+  EVP_MD_CTX_init(&ctx);
+  ret = EVP_DigestInit_ex(&ctx, type, impl) &&
+        EVP_DigestUpdate(&ctx, data, count) &&
+        EVP_DigestFinal_ex(&ctx, out_md, out_size);
+  EVP_MD_CTX_cleanup(&ctx);
+
+  return ret;
 }
 
 const EVP_MD *EVP_MD_CTX_get0_md(const EVP_MD_CTX *ctx) {

data/third_party/boringssl-with-bazel/{src/crypto → crypto}/fipsmodule/ec/ec.cc.inc

@@ -655,10 +655,12 @@ static int arbitrary_bignum_to_scalar(const EC_GROUP *group, EC_SCALAR *out,
   ERR_clear_error();
 
   // This is an unusual input, so we do not guarantee constant-time processing.
-  bssl::BN_CTXScope scope(ctx);
+  BN_CTX_start(ctx);
   BIGNUM *tmp = BN_CTX_get(ctx);
-  return tmp != nullptr && BN_nnmod(tmp, in, EC_GROUP_get0_order(group), ctx) &&
-         ec_bignum_to_scalar(group, out, tmp);
+  int ok = tmp != NULL && BN_nnmod(tmp, in, EC_GROUP_get0_order(group), ctx) &&
+           ec_bignum_to_scalar(group, out, tmp);
+  BN_CTX_end(ctx);
+  return ok;
 }
 
 int ec_point_mul_no_self_test(const EC_GROUP *group, EC_POINT *r,

data/third_party/boringssl-with-bazel/{src/crypto → crypto}/fipsmodule/rsa/padding.cc.inc

@@ -121,7 +121,8 @@ int RSA_padding_add_none(uint8_t *to, size_t to_len, const uint8_t *from,
 int PKCS1_MGF1(uint8_t *out, size_t len, const uint8_t *seed, size_t seed_len,
                const EVP_MD *md) {
   int ret = 0;
-  bssl::ScopedEVP_MD_CTX ctx;
+  EVP_MD_CTX ctx;
+  EVP_MD_CTX_init(&ctx);
   FIPS_service_indicator_lock_state();
 
   size_t md_len = EVP_MD_size(md);
@@ -132,21 +133,21 @@ int PKCS1_MGF1(uint8_t *out, size_t len, const uint8_t *seed, size_t seed_len,
     counter[1] = (uint8_t)(i >> 16);
     counter[2] = (uint8_t)(i >> 8);
     counter[3] = (uint8_t)i;
-    if (!EVP_DigestInit_ex(ctx.get(), md, nullptr) ||
-        !EVP_DigestUpdate(ctx.get(), seed, seed_len) ||
-        !EVP_DigestUpdate(ctx.get(), counter, sizeof(counter))) {
+    if (!EVP_DigestInit_ex(&ctx, md, NULL) ||
+        !EVP_DigestUpdate(&ctx, seed, seed_len) ||
+        !EVP_DigestUpdate(&ctx, counter, sizeof(counter))) {
       goto err;
     }
 
     if (md_len <= len) {
-      if (!EVP_DigestFinal_ex(ctx.get(), out, nullptr)) {
+      if (!EVP_DigestFinal_ex(&ctx, out, NULL)) {
         goto err;
       }
       out += md_len;
       len -= md_len;
     } else {
       uint8_t digest[EVP_MAX_MD_SIZE];
-      if (!EVP_DigestFinal_ex(ctx.get(), digest, nullptr)) {
+      if (!EVP_DigestFinal_ex(&ctx, digest, NULL)) {
         goto err;
       }
       OPENSSL_memcpy(out, digest, len);
@@ -157,6 +158,7 @@ int PKCS1_MGF1(uint8_t *out, size_t len, const uint8_t *seed, size_t seed_len,
   ret = 1;
 
 err:
+  EVP_MD_CTX_cleanup(&ctx);
   FIPS_service_indicator_unlock_state();
   return ret;
 }
@@ -173,7 +175,8 @@ int RSA_verify_PKCS1_PSS_mgf1(const RSA *rsa, const uint8_t *mHash,
   int ret = 0;
   uint8_t *DB = NULL;
   const uint8_t *H;
-  bssl::ScopedEVP_MD_CTX ctx;
+  EVP_MD_CTX ctx;
+  EVP_MD_CTX_init(&ctx);
   unsigned MSBits;
   size_t emLen, maskedDBLen, salt_start;
   FIPS_service_indicator_lock_state();
@@ -244,11 +247,11 @@ int RSA_verify_PKCS1_PSS_mgf1(const RSA *rsa, const uint8_t *mHash,
     goto err;
   }
   uint8_t H_[EVP_MAX_MD_SIZE];
-  if (!EVP_DigestInit_ex(ctx.get(), Hash, NULL) ||
-      !EVP_DigestUpdate(ctx.get(), kPSSZeroes, sizeof(kPSSZeroes)) ||
-      !EVP_DigestUpdate(ctx.get(), mHash, hLen) ||
-      !EVP_DigestUpdate(ctx.get(), DB + salt_start, maskedDBLen - salt_start) ||
-      !EVP_DigestFinal_ex(ctx.get(), H_, NULL)) {
+  if (!EVP_DigestInit_ex(&ctx, Hash, NULL) ||
+      !EVP_DigestUpdate(&ctx, kPSSZeroes, sizeof(kPSSZeroes)) ||
+      !EVP_DigestUpdate(&ctx, mHash, hLen) ||
+      !EVP_DigestUpdate(&ctx, DB + salt_start, maskedDBLen - salt_start) ||
+      !EVP_DigestFinal_ex(&ctx, H_, NULL)) {
     goto err;
   }
   if (OPENSSL_memcmp(H_, H, hLen) != 0) {
@@ -260,6 +263,7 @@ int RSA_verify_PKCS1_PSS_mgf1(const RSA *rsa, const uint8_t *mHash,
 
 err:
   OPENSSL_free(DB);
+  EVP_MD_CTX_cleanup(&ctx);
   FIPS_service_indicator_unlock_state();
   return ret;
 }
@@ -268,8 +272,7 @@ int RSA_padding_add_PKCS1_PSS_mgf1(const RSA *rsa, unsigned char *EM,
                                    const unsigned char *mHash,
                                    const EVP_MD *Hash, const EVP_MD *mgf1Hash,
                                    int sLenRequested) {
-  int ret = 0;
-  bssl::ScopedEVP_MD_CTX ctx;
+  int ret = 0, digest_ok;
   size_t maskedDBLen, MSBits, emLen;
   size_t hLen;
   unsigned char *H, *salt = NULL, *p;
@@ -330,11 +333,15 @@ int RSA_padding_add_PKCS1_PSS_mgf1(const RSA *rsa, unsigned char *EM,
   maskedDBLen = emLen - hLen - 1;
   H = EM + maskedDBLen;
 
-  if (!EVP_DigestInit_ex(ctx.get(), Hash, NULL) ||
-      !EVP_DigestUpdate(ctx.get(), kPSSZeroes, sizeof(kPSSZeroes)) ||
-      !EVP_DigestUpdate(ctx.get(), mHash, hLen) ||
-      !EVP_DigestUpdate(ctx.get(), salt, sLen) ||
-      !EVP_DigestFinal_ex(ctx.get(), H, NULL)) {
+  EVP_MD_CTX ctx;
+  EVP_MD_CTX_init(&ctx);
+  digest_ok = EVP_DigestInit_ex(&ctx, Hash, NULL) &&
+              EVP_DigestUpdate(&ctx, kPSSZeroes, sizeof(kPSSZeroes)) &&
+              EVP_DigestUpdate(&ctx, mHash, hLen) &&
+              EVP_DigestUpdate(&ctx, salt, sLen) &&
+              EVP_DigestFinal_ex(&ctx, H, NULL);
+  EVP_MD_CTX_cleanup(&ctx);
+  if (!digest_ok) {
     goto err;
   }
 

data/third_party/boringssl-with-bazel/{src/crypto → crypto}/fipsmodule/rsa/rsa.cc.inc

@@ -718,15 +718,15 @@ static int check_mod_inverse(int *out_ok, const BIGNUM *a, const BIGNUM *ainv,
   // Note |bn_mul_consttime| and |bn_div_consttime| do not scale linearly, but
   // checking |ainv| is in range bounds the running time, assuming |m|'s bounds
   // were checked by the caller.
-  bssl::BN_CTXScope scope(ctx);
+  BN_CTX_start(ctx);
   BIGNUM *tmp = BN_CTX_get(ctx);
-  if (tmp == nullptr ||  //
-      !bn_mul_consttime(tmp, a, ainv, ctx) ||
-      !bn_div_consttime(NULL, tmp, tmp, m, m_min_bits, ctx)) {
-    return 0;
+  int ret = tmp != NULL && bn_mul_consttime(tmp, a, ainv, ctx) &&
+            bn_div_consttime(NULL, tmp, tmp, m, m_min_bits, ctx);
+  if (ret) {
+    *out_ok = constant_time_declassify_int(BN_is_one(tmp));
   }
-  *out_ok = constant_time_declassify_int(BN_is_one(tmp));
-  return 1;
+  BN_CTX_end(ctx);
+  return ret;
 }
 
 int RSA_check_key(const RSA *key) {