grpc 1.80.0 → 1.81.0

data/third_party/boringssl-with-bazel/{src/crypto → crypto}/pkcs8/pkcs8_x509.cc

@@ -904,15 +904,15 @@ static int add_bag_attributes(CBB *bag, const char *name, size_t name_len,
     return 1;  // Omit the OPTIONAL SET.
   }
   // See https://tools.ietf.org/html/rfc7292#section-4.2.
-  CBB attrs, attr, values, value;
+  CBB attrs, attr, oid, values, value;
   if (!CBB_add_asn1(bag, &attrs, CBS_ASN1_SET)) {
     return 0;
   }
   if (name_len != 0) {
     // See https://tools.ietf.org/html/rfc2985, section 5.5.1.
     if (!CBB_add_asn1(&attrs, &attr, CBS_ASN1_SEQUENCE) ||
-        !CBB_add_asn1_element(&attr, CBS_ASN1_OBJECT, kFriendlyName,
-                              sizeof(kFriendlyName)) ||
+        !CBB_add_asn1(&attr, &oid, CBS_ASN1_OBJECT) ||
+        !CBB_add_bytes(&oid, kFriendlyName, sizeof(kFriendlyName)) ||
         !CBB_add_asn1(&attr, &values, CBS_ASN1_SET) ||
         !CBB_add_asn1(&values, &value, CBS_ASN1_BMPSTRING)) {
       return 0;
@@ -931,10 +931,11 @@ static int add_bag_attributes(CBB *bag, const char *name, size_t name_len,
   if (key_id_len != 0) {
     // See https://tools.ietf.org/html/rfc2985, section 5.5.2.
     if (!CBB_add_asn1(&attrs, &attr, CBS_ASN1_SEQUENCE) ||
-        !CBB_add_asn1_element(&attr, CBS_ASN1_OBJECT, kLocalKeyID,
-                              sizeof(kLocalKeyID)) ||
+        !CBB_add_asn1(&attr, &oid, CBS_ASN1_OBJECT) ||
+        !CBB_add_bytes(&oid, kLocalKeyID, sizeof(kLocalKeyID)) ||
         !CBB_add_asn1(&attr, &values, CBS_ASN1_SET) ||
-        !CBB_add_asn1_octet_string(&values, key_id, key_id_len)) {
+        !CBB_add_asn1(&values, &value, CBS_ASN1_OCTETSTRING) ||
+        !CBB_add_bytes(&value, key_id, key_id_len)) {
       return 0;
     }
   }
@@ -943,17 +944,17 @@ static int add_bag_attributes(CBB *bag, const char *name, size_t name_len,
 
 static int add_cert_bag(CBB *cbb, X509 *cert, const char *name,
                         const uint8_t *key_id, size_t key_id_len) {
-  CBB bag, bag_contents, cert_bag, wrapped_cert, cert_value;
+  CBB bag, bag_oid, bag_contents, cert_bag, cert_type, wrapped_cert, cert_value;
   if (  // See https://tools.ietf.org/html/rfc7292#section-4.2.
       !CBB_add_asn1(cbb, &bag, CBS_ASN1_SEQUENCE) ||
-      !CBB_add_asn1_element(&bag, CBS_ASN1_OBJECT, kCertBag,
-                            sizeof(kCertBag)) ||
+      !CBB_add_asn1(&bag, &bag_oid, CBS_ASN1_OBJECT) ||
+      !CBB_add_bytes(&bag_oid, kCertBag, sizeof(kCertBag)) ||
       !CBB_add_asn1(&bag, &bag_contents,
                     CBS_ASN1_CONSTRUCTED | CBS_ASN1_CONTEXT_SPECIFIC | 0) ||
       // See https://tools.ietf.org/html/rfc7292#section-4.2.3.
       !CBB_add_asn1(&bag_contents, &cert_bag, CBS_ASN1_SEQUENCE) ||
-      !CBB_add_asn1_element(&cert_bag, CBS_ASN1_OBJECT, kX509Certificate,
-                            sizeof(kX509Certificate)) ||
+      !CBB_add_asn1(&cert_bag, &cert_type, CBS_ASN1_OBJECT) ||
+      !CBB_add_bytes(&cert_type, kX509Certificate, sizeof(kX509Certificate)) ||
       !CBB_add_asn1(&cert_bag, &wrapped_cert,
                     CBS_ASN1_CONSTRUCTED | CBS_ASN1_CONTEXT_SPECIFIC | 0) ||
       !CBB_add_asn1(&wrapped_cert, &cert_value, CBS_ASN1_OCTETSTRING)) {
@@ -1018,12 +1019,12 @@ static int add_encrypted_data(CBB *out, int pbe_nid,
   }
 
   bssl::ScopedEVP_CIPHER_CTX ctx;
-  CBB content_info, wrapper, encrypted_data, encrypted_content_info,
-      encrypted_content;
+  CBB content_info, type, wrapper, encrypted_data, encrypted_content_info,
+      inner_type, encrypted_content;
   if (  // Add the ContentInfo wrapping.
       !CBB_add_asn1(out, &content_info, CBS_ASN1_SEQUENCE) ||
-      !CBB_add_asn1_element(&content_info, CBS_ASN1_OBJECT, kPKCS7EncryptedData,
-                            sizeof(kPKCS7EncryptedData)) ||
+      !CBB_add_asn1(&content_info, &type, CBS_ASN1_OBJECT) ||
+      !CBB_add_bytes(&type, kPKCS7EncryptedData, sizeof(kPKCS7EncryptedData)) ||
       !CBB_add_asn1(&content_info, &wrapper,
                     CBS_ASN1_CONSTRUCTED | CBS_ASN1_CONTEXT_SPECIFIC | 0) ||
       // See https://tools.ietf.org/html/rfc2315#section-13.
@@ -1032,8 +1033,8 @@ static int add_encrypted_data(CBB *out, int pbe_nid,
       // See https://tools.ietf.org/html/rfc2315#section-10.1.
       !CBB_add_asn1(&encrypted_data, &encrypted_content_info,
                     CBS_ASN1_SEQUENCE) ||
-      !CBB_add_asn1_element(&encrypted_content_info, CBS_ASN1_OBJECT,
-                            kPKCS7Data, sizeof(kPKCS7Data)) ||
+      !CBB_add_asn1(&encrypted_content_info, &inner_type, CBS_ASN1_OBJECT) ||
+      !CBB_add_bytes(&inner_type, kPKCS7Data, sizeof(kPKCS7Data)) ||
       // Set up encryption and fill in contentEncryptionAlgorithm.
       !pkcs12_pbe_encrypt_init(&encrypted_content_info, ctx.get(), pbe_nid,
                                pbe_cipher, iterations, password, password_len,
@@ -1142,14 +1143,15 @@ PKCS12 *PKCS12_create(const char *password, const char *name,
 
   // See https://tools.ietf.org/html/rfc7292#section-4.
   PKCS12 *ret = NULL;
-  CBB cbb, pfx, auth_safe, auth_safe_wrapper, auth_safe_data, content_infos;
+  CBB cbb, pfx, auth_safe, auth_safe_oid, auth_safe_wrapper, auth_safe_data,
+      content_infos;
   uint8_t mac_key[EVP_MAX_MD_SIZE];
   if (!CBB_init(&cbb, 0) || !CBB_add_asn1(&cbb, &pfx, CBS_ASN1_SEQUENCE) ||
       !CBB_add_asn1_uint64(&pfx, 3) ||
       // auth_safe is a data ContentInfo.
       !CBB_add_asn1(&pfx, &auth_safe, CBS_ASN1_SEQUENCE) ||
-      !CBB_add_asn1_element(&auth_safe, CBS_ASN1_OBJECT, kPKCS7Data,
-                            sizeof(kPKCS7Data)) ||
+      !CBB_add_asn1(&auth_safe, &auth_safe_oid, CBS_ASN1_OBJECT) ||
+      !CBB_add_bytes(&auth_safe_oid, kPKCS7Data, sizeof(kPKCS7Data)) ||
       !CBB_add_asn1(&auth_safe, &auth_safe_wrapper,
                     CBS_ASN1_CONSTRUCTED | CBS_ASN1_CONTEXT_SPECIFIC | 0) ||
       !CBB_add_asn1(&auth_safe_wrapper, &auth_safe_data,
@@ -1169,10 +1171,10 @@ PKCS12 *PKCS12_create(const char *password, const char *name,
       // OpenSSL does not do this. We keep them separate for consistency. (Keys,
       // even when encrypted, are always placed in unencrypted ContentInfos.
       // PKCS#12 defines bag-level encryption for keys.)
-      CBB content_info, wrapper, data;
+      CBB content_info, oid, wrapper, data;
       if (!CBB_add_asn1(&content_infos, &content_info, CBS_ASN1_SEQUENCE) ||
-          !CBB_add_asn1_element(&content_info, CBS_ASN1_OBJECT, kPKCS7Data,
-                                sizeof(kPKCS7Data)) ||
+          !CBB_add_asn1(&content_info, &oid, CBS_ASN1_OBJECT) ||
+          !CBB_add_bytes(&oid, kPKCS7Data, sizeof(kPKCS7Data)) ||
           !CBB_add_asn1(&content_info, &wrapper,
                         CBS_ASN1_CONSTRUCTED | CBS_ASN1_CONTEXT_SPECIFIC | 0) ||
           !CBB_add_asn1(&wrapper, &data, CBS_ASN1_OCTETSTRING) ||
@@ -1209,22 +1211,23 @@ PKCS12 *PKCS12_create(const char *password, const char *name,
   // inside an encrypted ContentInfo, but OpenSSL does not do this and some
   // PKCS#12 consumers do not support KeyBags.)
   if (pkey != NULL) {
-    CBB content_info, wrapper, data, safe_contents, bag, bag_contents;
+    CBB content_info, oid, wrapper, data, safe_contents, bag, bag_oid,
+        bag_contents;
     if (  // Add another data ContentInfo.
         !CBB_add_asn1(&content_infos, &content_info, CBS_ASN1_SEQUENCE) ||
-        !CBB_add_asn1_element(&content_info, CBS_ASN1_OBJECT, kPKCS7Data,
-                              sizeof(kPKCS7Data)) ||
+        !CBB_add_asn1(&content_info, &oid, CBS_ASN1_OBJECT) ||
+        !CBB_add_bytes(&oid, kPKCS7Data, sizeof(kPKCS7Data)) ||
         !CBB_add_asn1(&content_info, &wrapper,
                       CBS_ASN1_CONSTRUCTED | CBS_ASN1_CONTEXT_SPECIFIC | 0) ||
         !CBB_add_asn1(&wrapper, &data, CBS_ASN1_OCTETSTRING) ||
         !CBB_add_asn1(&data, &safe_contents, CBS_ASN1_SEQUENCE) ||
         // Add a SafeBag containing a PKCS8ShroudedKeyBag.
-        !CBB_add_asn1(&safe_contents, &bag, CBS_ASN1_SEQUENCE)) {
+        !CBB_add_asn1(&safe_contents, &bag, CBS_ASN1_SEQUENCE) ||
+        !CBB_add_asn1(&bag, &bag_oid, CBS_ASN1_OBJECT)) {
       goto err;
     }
     if (key_nid < 0) {
-      if (!CBB_add_asn1_element(&bag, CBS_ASN1_OBJECT, kKeyBag,
-                                sizeof(kKeyBag)) ||
+      if (!CBB_add_bytes(&bag_oid, kKeyBag, sizeof(kKeyBag)) ||
           !CBB_add_asn1(&bag, &bag_contents,
                         CBS_ASN1_CONSTRUCTED | CBS_ASN1_CONTEXT_SPECIFIC | 0) ||
           !EVP_marshal_private_key(&bag_contents, pkey)) {
@@ -1238,8 +1241,8 @@ PKCS12 *PKCS12_create(const char *password, const char *name,
       if (cipher != nullptr) {
         key_nid = -1;
       }
-      if (!CBB_add_asn1_element(&bag, CBS_ASN1_OBJECT, kPKCS8ShroudedKeyBag,
-                                sizeof(kPKCS8ShroudedKeyBag)) ||
+      if (!CBB_add_bytes(&bag_oid, kPKCS8ShroudedKeyBag,
+                         sizeof(kPKCS8ShroudedKeyBag)) ||
           !CBB_add_asn1(&bag, &bag_contents,
                         CBS_ASN1_CONSTRUCTED | CBS_ASN1_CONTEXT_SPECIFIC | 0) ||
           !PKCS8_marshal_encrypted_private_key(
@@ -1276,7 +1279,7 @@ PKCS12 *PKCS12_create(const char *password, const char *name,
       goto err;
     }
 
-    CBB mac_data, digest_info;
+    CBB mac_data, digest_info, mac_cbb, mac_salt_cbb;
     if (!CBB_add_asn1(&pfx, &mac_data, CBS_ASN1_SEQUENCE) ||
         !CBB_add_asn1(&mac_data, &digest_info, CBS_ASN1_SEQUENCE) ||
         // OpenSSL and NSS always include a NULL parameter with the digest
@@ -1290,8 +1293,10 @@ PKCS12 *PKCS12_create(const char *password, const char *name,
         //
         // We match OpenSSL, NSS, and RSASSA-PKCS1-v1_5 in including the NULL.
         !EVP_marshal_digest_algorithm(&digest_info, mac_md) ||
-        !CBB_add_asn1_octet_string(&digest_info, mac, mac_len) ||
-        !CBB_add_asn1_octet_string(&mac_data, mac_salt, sizeof(mac_salt)) ||
+        !CBB_add_asn1(&digest_info, &mac_cbb, CBS_ASN1_OCTETSTRING) ||
+        !CBB_add_bytes(&mac_cbb, mac, mac_len) ||
+        !CBB_add_asn1(&mac_data, &mac_salt_cbb, CBS_ASN1_OCTETSTRING) ||
+        !CBB_add_bytes(&mac_salt_cbb, mac_salt, sizeof(mac_salt)) ||
         // The iteration count has a DEFAULT of 1, but RFC 7292 says "The
         // default is for historical reasons and its use is deprecated." Thus we
         // explicitly encode the iteration count, though it is not valid DER.

data/third_party/boringssl-with-bazel/{src/crypto → crypto}/rsa/rsa_crypt.cc

@@ -349,21 +349,25 @@ int RSA_encrypt(RSA *rsa, size_t *out_len, uint8_t *out, size_t max_out,
   }
 
   const unsigned rsa_size = RSA_size(rsa);
+  BIGNUM *f, *result;
+  uint8_t *buf = NULL;
+  BN_CTX *ctx = NULL;
+  int i, ret = 0;
+
   if (max_out < rsa_size) {
     OPENSSL_PUT_ERROR(RSA, RSA_R_OUTPUT_BUFFER_TOO_SMALL);
     return 0;
   }
 
-  bssl::UniquePtr<BN_CTX> ctx(BN_CTX_new());
-  if (ctx == nullptr) {
-    return 0;
+  ctx = BN_CTX_new();
+  if (ctx == NULL) {
+    goto err;
   }
 
-  bssl::BN_CTXScope scope(ctx.get());
-  BIGNUM *f = BN_CTX_get(ctx.get());
-  BIGNUM *result = BN_CTX_get(ctx.get());
-  uint8_t *buf = reinterpret_cast<uint8_t *>(OPENSSL_malloc(rsa_size));
-  int i, ret = 0;
+  BN_CTX_start(ctx);
+  f = BN_CTX_get(ctx);
+  result = BN_CTX_get(ctx);
+  buf = reinterpret_cast<uint8_t *>(OPENSSL_malloc(rsa_size));
   if (!f || !result || !buf) {
     goto err;
   }
@@ -374,8 +378,8 @@ int RSA_encrypt(RSA *rsa, size_t *out_len, uint8_t *out, size_t max_out,
       break;
     case RSA_PKCS1_OAEP_PADDING:
       // Use the default parameters: SHA-1 for both hashes and no label.
-      i = RSA_padding_add_PKCS1_OAEP_mgf1(buf, rsa_size, in, in_len, nullptr, 0,
-                                          nullptr, nullptr);
+      i = RSA_padding_add_PKCS1_OAEP_mgf1(buf, rsa_size, in, in_len, NULL, 0,
+                                          NULL, NULL);
       break;
     case RSA_NO_PADDING:
       i = RSA_padding_add_none(buf, rsa_size, in, in_len);
@@ -389,7 +393,7 @@ int RSA_encrypt(RSA *rsa, size_t *out_len, uint8_t *out, size_t max_out,
     goto err;
   }
 
-  if (BN_bin2bn(buf, rsa_size, f) == nullptr) {
+  if (BN_bin2bn(buf, rsa_size, f) == NULL) {
     goto err;
   }
 
@@ -399,9 +403,8 @@ int RSA_encrypt(RSA *rsa, size_t *out_len, uint8_t *out, size_t max_out,
     goto err;
   }
 
-  if (!BN_MONT_CTX_set_locked(&rsa->mont_n, &rsa->lock, rsa->n, ctx.get()) ||
-      !BN_mod_exp_mont(result, f, rsa->e, &rsa->mont_n->N, ctx.get(),
-                       rsa->mont_n)) {
+  if (!BN_MONT_CTX_set_locked(&rsa->mont_n, &rsa->lock, rsa->n, ctx) ||
+      !BN_mod_exp_mont(result, f, rsa->e, &rsa->mont_n->N, ctx, rsa->mont_n)) {
     goto err;
   }
 
@@ -416,7 +419,12 @@ int RSA_encrypt(RSA *rsa, size_t *out_len, uint8_t *out, size_t max_out,
   ret = 1;
 
 err:
+  if (ctx != NULL) {
+    BN_CTX_end(ctx);
+    BN_CTX_free(ctx);
+  }
   OPENSSL_free(buf);
+
   return ret;
 }
 

data/third_party/boringssl-with-bazel/{src/crypto → crypto}/x509/a_sign.cc

@@ -31,11 +31,13 @@ int ASN1_item_sign(const ASN1_ITEM *it, X509_ALGOR *algor1, X509_ALGOR *algor2,
     OPENSSL_PUT_ERROR(ASN1, ASN1_R_WRONG_TYPE);
     return 0;
   }
-  bssl::ScopedEVP_MD_CTX ctx;
-  if (!EVP_DigestSignInit(ctx.get(), nullptr, type, nullptr, pkey)) {
+  EVP_MD_CTX ctx;
+  EVP_MD_CTX_init(&ctx);
+  if (!EVP_DigestSignInit(&ctx, NULL, type, NULL, pkey)) {
+    EVP_MD_CTX_cleanup(&ctx);
     return 0;
   }
-  return ASN1_item_sign_ctx(it, algor1, algor2, signature, asn, ctx.get());
+  return ASN1_item_sign_ctx(it, algor1, algor2, signature, asn, &ctx);
 }
 
 int ASN1_item_sign_ctx(const ASN1_ITEM *it, X509_ALGOR *algor1,

data/third_party/boringssl-with-bazel/{src/crypto → crypto}/x509/asn1_gen.cc

@@ -58,23 +58,27 @@ static int generate_v3(CBB *cbb, const char *str, const X509V3_CTX *cnf,
 static int bitstr_cb(const char *elem, size_t len, void *bitstr);
 
 ASN1_TYPE *ASN1_generate_v3(const char *str, const X509V3_CTX *cnf) {
-  bssl::ScopedCBB cbb;
-  if (!CBB_init(cbb.get(), 0) ||  //
-      !generate_v3(cbb.get(), str, cnf, /*tag=*/0, ASN1_GEN_FORMAT_ASCII,
+  CBB cbb;
+  if (!CBB_init(&cbb, 0) ||  //
+      !generate_v3(&cbb, str, cnf, /*tag=*/0, ASN1_GEN_FORMAT_ASCII,
                    /*depth=*/0)) {
-    return nullptr;
+    CBB_cleanup(&cbb);
+    return NULL;
   }
 
   // While not strictly necessary to avoid a DoS (we rely on any super-linear
   // checks being performed internally), cap the overall output to
   // |ASN1_GEN_MAX_OUTPUT| so the externally-visible behavior is consistent.
-  if (CBB_len(cbb.get()) > ASN1_GEN_MAX_OUTPUT) {
+  if (CBB_len(&cbb) > ASN1_GEN_MAX_OUTPUT) {
     OPENSSL_PUT_ERROR(ASN1, ASN1_R_TOO_LONG);
-    return nullptr;
+    CBB_cleanup(&cbb);
+    return NULL;
   }
 
-  const uint8_t *der = CBB_data(cbb.get());
-  return d2i_ASN1_TYPE(nullptr, &der, CBB_len(cbb.get()));
+  const uint8_t *der = CBB_data(&cbb);
+  ASN1_TYPE *ret = d2i_ASN1_TYPE(NULL, &der, CBB_len(&cbb));
+  CBB_cleanup(&cbb);
+  return ret;
 }
 
 static int cbs_str_equal(const CBS *cbs, const char *str) {

data/third_party/boringssl-with-bazel/{src/crypto → crypto}/x509/v3_conf.cc

@@ -226,41 +226,49 @@ static int v3_check_generic(const char **value) {
 static X509_EXTENSION *v3_generic_extension(const char *ext, const char *value,
                                             int crit, int gen_type,
                                             const X509V3_CTX *ctx) {
-  bssl::UniquePtr<ASN1_OBJECT> obj(OBJ_txt2obj(ext, 0));
-  if (obj == nullptr) {
+  unsigned char *ext_der = NULL;
+  size_t ext_len = 0;
+  ASN1_OBJECT *obj = NULL;
+  ASN1_OCTET_STRING *oct = NULL;
+  X509_EXTENSION *extension = NULL;
+  if (!(obj = OBJ_txt2obj(ext, 0))) {
     OPENSSL_PUT_ERROR(X509V3, X509V3_R_EXTENSION_NAME_ERROR);
     ERR_add_error_data(2, "name=", ext);
-    return nullptr;
+    goto err;
   }
 
-  bssl::UniquePtr<unsigned char> ext_der;
-  size_t ext_len = 0;
   if (gen_type == 1) {
-    ext_der.reset(x509v3_hex_to_bytes(value, &ext_len));
+    ext_der = x509v3_hex_to_bytes(value, &ext_len);
   } else if (gen_type == 2) {
-    ext_der.reset(generic_asn1(value, ctx, &ext_len));
+    ext_der = generic_asn1(value, ctx, &ext_len);
   }
 
-  if (ext_der == nullptr) {
+  if (ext_der == NULL) {
     OPENSSL_PUT_ERROR(X509V3, X509V3_R_EXTENSION_VALUE_ERROR);
     ERR_add_error_data(2, "value=", value);
-    return nullptr;
+    goto err;
   }
 
   if (ext_len > INT_MAX) {
     OPENSSL_PUT_ERROR(X509V3, ERR_R_OVERFLOW);
-    return nullptr;
+    goto err;
   }
 
-  bssl::UniquePtr<ASN1_OCTET_STRING> oct(ASN1_OCTET_STRING_new());
-  if (oct == nullptr) {
-    return nullptr;
+  oct = ASN1_OCTET_STRING_new();
+  if (oct == NULL) {
+    goto err;
   }
 
-  ASN1_STRING_set0(oct.get(), ext_der.get(), (int)ext_len);
-  ext_der.release();  // ASN1_STRING_set0 took ownership.
+  ASN1_STRING_set0(oct, ext_der, (int)ext_len);
+  ext_der = NULL;
+
+  extension = X509_EXTENSION_create_by_OBJ(NULL, obj, crit, oct);
 
-  return X509_EXTENSION_create_by_OBJ(nullptr, obj.get(), crit, oct.get());
+err:
+  ASN1_OBJECT_free(obj);
+  ASN1_OCTET_STRING_free(oct);
+  OPENSSL_free(ext_der);
+  return extension;
 }
 
 static unsigned char *generic_asn1(const char *value, const X509V3_CTX *ctx,

data/third_party/boringssl-with-bazel/{src/crypto → crypto}/x509/v3_info.cc

@@ -122,40 +122,43 @@ err:
 static void *v2i_AUTHORITY_INFO_ACCESS(const X509V3_EXT_METHOD *method,
                                        const X509V3_CTX *ctx,
                                        const STACK_OF(CONF_VALUE) *nval) {
-  bssl::UniquePtr<AUTHORITY_INFO_ACCESS> ainfo(sk_ACCESS_DESCRIPTION_new_null());
-  if (ainfo == nullptr) {
-    return nullptr;
+  AUTHORITY_INFO_ACCESS *ainfo = NULL;
+  ACCESS_DESCRIPTION *acc;
+  if (!(ainfo = sk_ACCESS_DESCRIPTION_new_null())) {
+    return NULL;
   }
   for (size_t i = 0; i < sk_CONF_VALUE_num(nval); i++) {
     const CONF_VALUE *cnf = sk_CONF_VALUE_value(nval, i);
-    bssl::UniquePtr<ACCESS_DESCRIPTION> acc(ACCESS_DESCRIPTION_new());
-    if (acc == nullptr) {
-      return nullptr;
+    if (!(acc = ACCESS_DESCRIPTION_new()) ||
+        !sk_ACCESS_DESCRIPTION_push(ainfo, acc)) {
+      goto err;
     }
     char *ptmp = strchr(cnf->name, ';');
     if (!ptmp) {
       OPENSSL_PUT_ERROR(X509V3, X509V3_R_INVALID_SYNTAX);
-      return nullptr;
+      goto err;
     }
     CONF_VALUE ctmp;
     ctmp.name = ptmp + 1;
     ctmp.value = cnf->value;
     if (!v2i_GENERAL_NAME_ex(acc->location, method, ctx, &ctmp, 0)) {
-      return nullptr;
+      goto err;
     }
-    bssl::UniquePtr<char> objtmp(OPENSSL_strndup(cnf->name, ptmp - cnf->name));
-    if (objtmp == nullptr) {
-      return nullptr;
+    char *objtmp = OPENSSL_strndup(cnf->name, ptmp - cnf->name);
+    if (objtmp == NULL) {
+      goto err;
     }
-    acc->method = OBJ_txt2obj(objtmp.get(), 0);
+    acc->method = OBJ_txt2obj(objtmp, 0);
     if (!acc->method) {
       OPENSSL_PUT_ERROR(X509V3, X509V3_R_BAD_OBJECT);
-      ERR_add_error_data(2, "value=", objtmp.get());
-      return nullptr;
-    }
-    if (!bssl::PushToStack(ainfo.get(), std::move(acc))) {
-      return nullptr;
+      ERR_add_error_data(2, "value=", objtmp);
+      OPENSSL_free(objtmp);
+      goto err;
     }
+    OPENSSL_free(objtmp);
   }
-  return ainfo.release();
+  return ainfo;
+err:
+  sk_ACCESS_DESCRIPTION_pop_free(ainfo, ACCESS_DESCRIPTION_free);
+  return NULL;
 }

data/third_party/boringssl-with-bazel/{src/crypto → crypto}/x509/x_x509.cc

@@ -17,7 +17,6 @@
 #include <stdio.h>
 
 #include <openssl/asn1t.h>
-#include <openssl/bytestring.h>
 #include <openssl/evp.h>
 #include <openssl/mem.h>
 #include <openssl/obj.h>
@@ -110,7 +109,7 @@ static X509 *x509_parse(CBS *cbs, CRYPTO_BUFFER *buf) {
       !CBS_get_asn1_element(&cert, &tbs, CBS_ASN1_SEQUENCE) ||
       !CBS_get_asn1_element(&cert, &sigalg, CBS_ASN1_SEQUENCE)) {
     OPENSSL_PUT_ERROR(ASN1, ASN1_R_DECODE_ERROR);
-    return nullptr;
+    return NULL;
   }
 
   // For just the signature field, we accept non-minimal BER lengths, though not
@@ -122,70 +121,76 @@ static X509 *x509_parse(CBS *cbs, CRYPTO_BUFFER *buf) {
   size_t header_len;
   int indefinite;
   if (!CBS_get_any_ber_asn1_element(&cert, &sig, &tag, &header_len,
-                                    /*out_ber_found=*/nullptr,
+                                    /*out_ber_found=*/NULL,
                                     &indefinite) ||
       tag != CBS_ASN1_BITSTRING || indefinite ||  //
       !CBS_skip(&sig, header_len) ||              //
       CBS_len(&cert) != 0) {
     OPENSSL_PUT_ERROR(ASN1, ASN1_R_DECODE_ERROR);
-    return nullptr;
+    return NULL;
   }
 
-  bssl::UniquePtr<X509> ret(x509_new_null());
-  if (ret == nullptr) {
-    return nullptr;
+  X509 *ret = x509_new_null();
+  if (ret == NULL) {
+    return NULL;
   }
 
-  // TODO(crbug.com/boringssl/443): When the rest of the library is decoupled
-  // from the tasn_*.c implementation, replace this with |CBS|-based
-  // functions.
-  const uint8_t *inp = CBS_data(&tbs);
-  if (ASN1_item_ex_d2i((ASN1_VALUE **)&ret->cert_info, &inp, CBS_len(&tbs),
-                       ASN1_ITEM_rptr(X509_CINF), /*tag=*/-1,
-                       /*aclass=*/0, /*opt=*/0, buf) <= 0 ||
-      inp != CBS_data(&tbs) + CBS_len(&tbs)) {
-    return nullptr;
-  }
-
-  inp = CBS_data(&sigalg);
-  ret->sig_alg = d2i_X509_ALGOR(nullptr, &inp, CBS_len(&sigalg));
-  if (ret->sig_alg == nullptr || inp != CBS_data(&sigalg) + CBS_len(&sigalg)) {
-    return nullptr;
-  }
-
-  inp = CBS_data(&sig);
-  ret->signature = c2i_ASN1_BIT_STRING(nullptr, &inp, CBS_len(&sig));
-  if (ret->signature == nullptr || inp != CBS_data(&sig) + CBS_len(&sig)) {
-    return nullptr;
-  }
-
-  // The version must be one of v1(0), v2(1), or v3(2).
-  long version = X509_VERSION_1;
-  if (ret->cert_info->version != nullptr) {
-    version = ASN1_INTEGER_get(ret->cert_info->version);
-    // TODO(https://crbug.com/boringssl/364): |X509_VERSION_1| should
-    // also be rejected here. This means an explicitly-encoded X.509v1
-    // version. v1 is DEFAULT, so DER requires it be omitted.
-    if (version < X509_VERSION_1 || version > X509_VERSION_3) {
-      OPENSSL_PUT_ERROR(X509, X509_R_INVALID_VERSION);
-      return nullptr;
+  {
+    // TODO(crbug.com/boringssl/443): When the rest of the library is decoupled
+    // from the tasn_*.c implementation, replace this with |CBS|-based
+    // functions.
+    const uint8_t *inp = CBS_data(&tbs);
+    if (ASN1_item_ex_d2i((ASN1_VALUE **)&ret->cert_info, &inp, CBS_len(&tbs),
+                         ASN1_ITEM_rptr(X509_CINF), /*tag=*/-1,
+                         /*aclass=*/0, /*opt=*/0, buf) <= 0 ||
+        inp != CBS_data(&tbs) + CBS_len(&tbs)) {
+      goto err;
     }
-  }
 
-  // Per RFC 5280, section 4.1.2.8, these fields require v2 or v3.
-  if (version == X509_VERSION_1 && (ret->cert_info->issuerUID != nullptr ||
-                                    ret->cert_info->subjectUID != nullptr)) {
-    OPENSSL_PUT_ERROR(X509, X509_R_INVALID_FIELD_FOR_VERSION);
-    return nullptr;
-  }
+    inp = CBS_data(&sigalg);
+    ret->sig_alg = d2i_X509_ALGOR(NULL, &inp, CBS_len(&sigalg));
+    if (ret->sig_alg == NULL || inp != CBS_data(&sigalg) + CBS_len(&sigalg)) {
+      goto err;
+    }
+
+    inp = CBS_data(&sig);
+    ret->signature = c2i_ASN1_BIT_STRING(NULL, &inp, CBS_len(&sig));
+    if (ret->signature == NULL || inp != CBS_data(&sig) + CBS_len(&sig)) {
+      goto err;
+    }
+
+    // The version must be one of v1(0), v2(1), or v3(2).
+    long version = X509_VERSION_1;
+    if (ret->cert_info->version != NULL) {
+      version = ASN1_INTEGER_get(ret->cert_info->version);
+      // TODO(https://crbug.com/boringssl/364): |X509_VERSION_1| should
+      // also be rejected here. This means an explicitly-encoded X.509v1
+      // version. v1 is DEFAULT, so DER requires it be omitted.
+      if (version < X509_VERSION_1 || version > X509_VERSION_3) {
+        OPENSSL_PUT_ERROR(X509, X509_R_INVALID_VERSION);
+        goto err;
+      }
+    }
+
+    // Per RFC 5280, section 4.1.2.8, these fields require v2 or v3.
+    if (version == X509_VERSION_1 && (ret->cert_info->issuerUID != NULL ||
+                                      ret->cert_info->subjectUID != NULL)) {
+      OPENSSL_PUT_ERROR(X509, X509_R_INVALID_FIELD_FOR_VERSION);
+      goto err;
+    }
+
+    // Per RFC 5280, section 4.1.2.9, extensions require v3.
+    if (version != X509_VERSION_3 && ret->cert_info->extensions != NULL) {
+      OPENSSL_PUT_ERROR(X509, X509_R_INVALID_FIELD_FOR_VERSION);
+      goto err;
+    }
 
-  // Per RFC 5280, section 4.1.2.9, extensions require v3.
-  if (version != X509_VERSION_3 && ret->cert_info->extensions != nullptr) {
-    OPENSSL_PUT_ERROR(X509, X509_R_INVALID_FIELD_FOR_VERSION);
-    return nullptr;
+    return ret;
   }
 
-  return ret.release();
+err:
+  X509_free(ret);
+  return NULL;
 }
 
 X509 *d2i_X509(X509 **out, const uint8_t **inp, long len) {

data/third_party/boringssl-with-bazel/{src/crypto → crypto}/x509/x_x509a.cc

@@ -109,33 +109,49 @@ const uint8_t *X509_keyid_get0(const X509 *x, int *out_len) {
 }
 
 int X509_add1_trust_object(X509 *x, const ASN1_OBJECT *obj) {
-  bssl::UniquePtr<ASN1_OBJECT> objtmp(OBJ_dup(obj));
-  if (objtmp == nullptr) {
-    return 0;
+  X509_CERT_AUX *aux;
+  ASN1_OBJECT *objtmp = OBJ_dup(obj);
+  if (objtmp == NULL) {
+    goto err;
   }
-  X509_CERT_AUX *aux = aux_get(x);
-  if (aux->trust == nullptr) {
+  aux = aux_get(x);
+  if (aux->trust == NULL) {
     aux->trust = sk_ASN1_OBJECT_new_null();
-    if (aux->trust == nullptr) {
-      return 0;
+    if (aux->trust == NULL) {
+      goto err;
     }
   }
-  return bssl::PushToStack(aux->trust, std::move(objtmp));
+  if (!sk_ASN1_OBJECT_push(aux->trust, objtmp)) {
+    goto err;
+  }
+  return 1;
+
+err:
+  ASN1_OBJECT_free(objtmp);
+  return 0;
 }
 
 int X509_add1_reject_object(X509 *x, const ASN1_OBJECT *obj) {
-  bssl::UniquePtr<ASN1_OBJECT> objtmp(OBJ_dup(obj));
-  if (objtmp == nullptr) {
-    return 0;
+  X509_CERT_AUX *aux;
+  ASN1_OBJECT *objtmp = OBJ_dup(obj);
+  if (objtmp == NULL) {
+    goto err;
   }
-  X509_CERT_AUX *aux = aux_get(x);
-  if (aux->reject == nullptr) {
+  aux = aux_get(x);
+  if (aux->reject == NULL) {
     aux->reject = sk_ASN1_OBJECT_new_null();
-    if (aux->reject == nullptr) {
-      return 0;
+    if (aux->reject == NULL) {
+      goto err;
     }
   }
-  return bssl::PushToStack(aux->reject, std::move(objtmp));
+  if (!sk_ASN1_OBJECT_push(aux->reject, objtmp)) {
+    goto err;
+  }
+  return 1;
+
+err:
+  ASN1_OBJECT_free(objtmp);
+  return 0;
 }
 
 void X509_trust_clear(X509 *x) {