grpc 1.84.0.pre1 → 1.85.0.pre1

data/third_party/boringssl-with-bazel/crypto/fipsmodule/bn/gcd.cc.inc

@@ -19,6 +19,8 @@
 #include "internal.h"
 
 
+using namespace bssl;
+
 int BN_mod_inverse_odd(BIGNUM *out, int *out_no_inverse, const BIGNUM *a,
                        const BIGNUM *n, BN_CTX *ctx) {
   *out_no_inverse = 0;
@@ -33,23 +35,20 @@ int BN_mod_inverse_odd(BIGNUM *out, int *out_no_inverse, const BIGNUM *a,
     return 0;
   }
 
-  BIGNUM *A, *B, *X, *Y;
-  int ret = 0;
   int sign;
-
-  BN_CTX_start(ctx);
-  A = BN_CTX_get(ctx);
-  B = BN_CTX_get(ctx);
-  X = BN_CTX_get(ctx);
-  Y = BN_CTX_get(ctx);
+  BN_CTXScope scope(ctx);
+  BIGNUM *A = BN_CTX_get(ctx);
+  BIGNUM *B = BN_CTX_get(ctx);
+  BIGNUM *X = BN_CTX_get(ctx);
+  BIGNUM *Y = BN_CTX_get(ctx);
   BIGNUM *R = out;
-  if (Y == NULL) {
-    goto err;
+  if (Y == nullptr) {
+    return 0;
   }
 
   BN_zero(Y);
-  if (!BN_one(X) || BN_copy(B, a) == NULL || BN_copy(A, n) == NULL) {
-    goto err;
+  if (!BN_one(X) || BN_copy(B, a) == nullptr || BN_copy(A, n) == nullptr) {
+    return 0;
   }
   A->neg = 0;
   sign = -1;
@@ -80,17 +79,17 @@ int BN_mod_inverse_odd(BIGNUM *out, int *out_no_inverse, const BIGNUM *a,
 
       if (BN_is_odd(X)) {
         if (!BN_uadd(X, X, n)) {
-          goto err;
+          return 0;
         }
       }
       // now X is even, so we can easily divide it by two
       if (!BN_rshift1(X, X)) {
-        goto err;
+        return 0;
       }
     }
     if (shift > 0) {
       if (!BN_rshift(B, B, shift)) {
-        goto err;
+        return 0;
       }
     }
 
@@ -102,17 +101,17 @@ int BN_mod_inverse_odd(BIGNUM *out, int *out_no_inverse, const BIGNUM *a,
 
       if (BN_is_odd(Y)) {
         if (!BN_uadd(Y, Y, n)) {
-          goto err;
+          return 0;
         }
       }
       // now Y is even
       if (!BN_rshift1(Y, Y)) {
-        goto err;
+        return 0;
       }
     }
     if (shift > 0) {
       if (!BN_rshift(A, A, shift)) {
-        goto err;
+        return 0;
       }
     }
 
@@ -129,21 +128,21 @@ int BN_mod_inverse_odd(BIGNUM *out, int *out_no_inverse, const BIGNUM *a,
     if (BN_ucmp(B, A) >= 0) {
       // -sign*(X + Y)*a == B - A  (mod |n|)
       if (!BN_uadd(X, X, Y)) {
-        goto err;
+        return 0;
       }
       // NB: we could use BN_mod_add_quick(X, X, Y, n), but that
       // actually makes the algorithm slower
       if (!BN_usub(B, B, A)) {
-        goto err;
+        return 0;
       }
     } else {
       //  sign*(X + Y)*a == A - B  (mod |n|)
       if (!BN_uadd(Y, Y, X)) {
-        goto err;
+        return 0;
       }
       // as above, BN_mod_add_quick(Y, Y, X, n) would slow things down
       if (!BN_usub(A, A, B)) {
-        goto err;
+        return 0;
       }
     }
   }
@@ -151,7 +150,7 @@ int BN_mod_inverse_odd(BIGNUM *out, int *out_no_inverse, const BIGNUM *a,
   if (!BN_is_one(A)) {
     *out_no_inverse = 1;
     OPENSSL_PUT_ERROR(BN, BN_R_NO_INVERSE);
-    goto err;
+    return 0;
   }
 
   // The while loop (Euclid's algorithm) ends when
@@ -162,7 +161,7 @@ int BN_mod_inverse_odd(BIGNUM *out, int *out_no_inverse, const BIGNUM *a,
 
   if (sign < 0) {
     if (!BN_sub(Y, n, Y)) {
-      goto err;
+      return 0;
     }
   }
   // Now  Y*a  ==  A  (mod |n|).
@@ -170,61 +169,49 @@ int BN_mod_inverse_odd(BIGNUM *out, int *out_no_inverse, const BIGNUM *a,
   // Y*a == 1  (mod |n|)
   if (Y->neg || BN_ucmp(Y, n) >= 0) {
     if (!BN_nnmod(Y, Y, n, ctx)) {
-      goto err;
+      return 0;
     }
   }
   if (!BN_copy(R, Y)) {
-    goto err;
+    return 0;
   }
 
-  ret = 1;
-
-err:
-  BN_CTX_end(ctx);
-  return ret;
+  return 1;
 }
 
 BIGNUM *BN_mod_inverse(BIGNUM *out, const BIGNUM *a, const BIGNUM *n,
                        BN_CTX *ctx) {
-  BIGNUM *new_out = NULL;
-  if (out == NULL) {
-    new_out = BN_new();
-    if (new_out == NULL) {
-      return NULL;
+  UniquePtr<BIGNUM> new_out;
+  if (out == nullptr) {
+    new_out.reset(BN_new());
+    if (new_out == nullptr) {
+      return nullptr;
     }
-    out = new_out;
+    out = new_out.get();
   }
 
-  int ok = 0;
-  BIGNUM *a_reduced = NULL;
+  UniquePtr<BIGNUM> a_reduced;
   if (a->neg || BN_ucmp(a, n) >= 0) {
-    a_reduced = BN_dup(a);
-    if (a_reduced == NULL) {
-      goto err;
+    a_reduced.reset(BN_dup(a));
+    if (a_reduced == nullptr) {
+      return nullptr;
     }
-    if (!BN_nnmod(a_reduced, a_reduced, n, ctx)) {
-      goto err;
+    if (!BN_nnmod(a_reduced.get(), a_reduced.get(), n, ctx)) {
+      return nullptr;
     }
-    a = a_reduced;
+    a = a_reduced.get();
   }
 
   int no_inverse;
   if (!BN_is_odd(n)) {
     if (!bn_mod_inverse_consttime(out, &no_inverse, a, n, ctx)) {
-      goto err;
+      return nullptr;
     }
   } else if (!BN_mod_inverse_odd(out, &no_inverse, a, n, ctx)) {
-    goto err;
+    return nullptr;
   }
 
-  ok = 1;
-
-err:
-  if (!ok) {
-    BN_free(new_out);
-    out = NULL;
-  }
-  BN_free(a_reduced);
+  new_out.release();  // Passed to the caller via `out`.
   return out;
 }
 
@@ -232,7 +219,7 @@ int BN_mod_inverse_blinded(BIGNUM *out, int *out_no_inverse, const BIGNUM *a,
                            const BN_MONT_CTX *mont, BN_CTX *ctx) {
   *out_no_inverse = 0;
 
-  // |a| is secret, but it is required to be in range, so these comparisons may
+  // `a` is secret, but it is required to be in range, so these comparisons may
   // be leaked.
   if (BN_is_negative(a) ||
       constant_time_declassify_int(BN_cmp(a, &mont->N) >= 0)) {
@@ -240,61 +227,55 @@ int BN_mod_inverse_blinded(BIGNUM *out, int *out_no_inverse, const BIGNUM *a,
     return 0;
   }
 
-  int ret = 0;
-  BIGNUM blinding_factor;
-  BN_init(&blinding_factor);
+  UniquePtr<BIGNUM> blinding_factor(BN_new());
+  if (blinding_factor == nullptr) {
+    return 0;
+  }
 
-  // |BN_mod_inverse_odd| is leaky, so generate a secret blinding factor and
-  // blind |a|. This works because (ar)^-1 * r = a^-1, supposing r is
+  // `BN_mod_inverse_odd` is leaky, so generate a secret blinding factor and
+  // blind `a`. This works because (ar)^-1 * r = a^-1, supposing r is
   // invertible. If r is not invertible, this function will fail. However, we
   // only use this in RSA, where stumbling on an uninvertible element means
   // stumbling on the key's factorization. That is, if this function fails, the
   // RSA key was not actually a product of two large primes.
   //
   // TODO(crbug.com/boringssl/677): When the PRNG output is marked secret by
-  // default, the explicit |bn_secret| call can be removed.
-  if (!BN_rand_range_ex(&blinding_factor, 1, &mont->N)) {
-    goto err;
+  // default, the explicit `bn_secret` call can be removed.
+  if (!BN_rand_range_ex(blinding_factor.get(), 1, &mont->N)) {
+    return 0;
   }
-  bn_secret(&blinding_factor);
-  if (!BN_mod_mul_montgomery(out, &blinding_factor, a, mont, ctx)) {
-    goto err;
+  bn_secret(blinding_factor.get());
+  if (!BN_mod_mul_montgomery(out, blinding_factor.get(), a, mont, ctx)) {
+    return 0;
   }
 
-  // Once blinded, |out| is no longer secret, so it may be passed to a leaky
-  // mod inverse function. Note |blinding_factor| is secret, so |out| will be
+  // Once blinded, `out` is no longer secret, so it may be passed to a leaky
+  // mod inverse function. Note `blinding_factor` is secret, so `out` will be
   // secret again after multiplying.
   bn_declassify(out);
   if (!BN_mod_inverse_odd(out, out_no_inverse, out, &mont->N, ctx) ||
-      !BN_mod_mul_montgomery(out, &blinding_factor, out, mont, ctx)) {
-    goto err;
+      !BN_mod_mul_montgomery(out, blinding_factor.get(), out, mont, ctx)) {
+    return 0;
   }
 
-  ret = 1;
-
-err:
-  BN_free(&blinding_factor);
-  return ret;
+  return 1;
 }
 
-int bn_mod_inverse_prime(BIGNUM *out, const BIGNUM *a, const BIGNUM *p,
-                         BN_CTX *ctx, const BN_MONT_CTX *mont_p) {
-  BN_CTX_start(ctx);
+int bssl::bn_mod_inverse_prime(BIGNUM *out, const BIGNUM *a, const BIGNUM *p,
+                               BN_CTX *ctx, const BN_MONT_CTX *mont_p) {
+  BN_CTXScope scope(ctx);
   BIGNUM *p_minus_2 = BN_CTX_get(ctx);
-  int ok = p_minus_2 != NULL && BN_copy(p_minus_2, p) &&
-           BN_sub_word(p_minus_2, 2) &&
-           BN_mod_exp_mont(out, a, p_minus_2, p, ctx, mont_p);
-  BN_CTX_end(ctx);
-  return ok;
+  return p_minus_2 != nullptr && BN_copy(p_minus_2, p) &&
+         BN_sub_word(p_minus_2, 2) &&
+         BN_mod_exp_mont(out, a, p_minus_2, p, ctx, mont_p);
 }
 
-int bn_mod_inverse_secret_prime(BIGNUM *out, const BIGNUM *a, const BIGNUM *p,
-                                BN_CTX *ctx, const BN_MONT_CTX *mont_p) {
-  BN_CTX_start(ctx);
+int bssl::bn_mod_inverse_secret_prime(BIGNUM *out, const BIGNUM *a,
+                                      const BIGNUM *p, BN_CTX *ctx,
+                                      const BN_MONT_CTX *mont_p) {
+  BN_CTXScope scope(ctx);
   BIGNUM *p_minus_2 = BN_CTX_get(ctx);
-  int ok = p_minus_2 != NULL && BN_copy(p_minus_2, p) &&
-           BN_sub_word(p_minus_2, 2) &&
-           BN_mod_exp_mont_consttime(out, a, p_minus_2, p, ctx, mont_p);
-  BN_CTX_end(ctx);
-  return ok;
+  return p_minus_2 != nullptr && BN_copy(p_minus_2, p) &&
+         BN_sub_word(p_minus_2, 2) &&
+         BN_mod_exp_mont_consttime(out, a, p_minus_2, p, ctx, mont_p);
 }

data/third_party/boringssl-with-bazel/crypto/fipsmodule/bn/gcd_extra.cc.inc

@@ -21,6 +21,8 @@
 #include "internal.h"
 
 
+using namespace bssl;
+
 static BN_ULONG word_is_odd_mask(BN_ULONG a) { return (BN_ULONG)0 - (a & 1); }
 
 static void maybe_rshift1_words(BN_ULONG *a, BN_ULONG mask, BN_ULONG *tmp,
@@ -56,43 +58,42 @@ static int bn_gcd_consttime(BIGNUM *r, unsigned *out_shift, const BIGNUM *x,
   }
 
   // This is a constant-time implementation of Stein's algorithm (binary GCD).
-  int ret = 0;
-  BN_CTX_start(ctx);
+  BN_CTXScope scope(ctx);
   BIGNUM *u = BN_CTX_get(ctx);
   BIGNUM *v = BN_CTX_get(ctx);
   BIGNUM *tmp = BN_CTX_get(ctx);
   unsigned x_bits, y_bits, num_iters, shift;
-  if (u == NULL || v == NULL || tmp == NULL ||  //
+  if (u == nullptr || v == nullptr || tmp == nullptr ||  //
       !BN_copy(u, x) ||                         //
       !BN_copy(v, y) ||                         //
       !bn_resize_words(u, width) ||             //
       !bn_resize_words(v, width) ||             //
       !bn_resize_words(tmp, width)) {
-    goto err;
+    return 0;
   }
 
-  // Each loop iteration halves at least one of |u| and |v|. Thus we need at
+  // Each loop iteration halves at least one of `u` and `v`. Thus we need at
   // most the combined bit width of inputs for at least one value to be zero.
   x_bits = x->width * BN_BITS2;
   y_bits = y->width * BN_BITS2;
   num_iters = x_bits + y_bits;
   if (num_iters < x_bits) {
     OPENSSL_PUT_ERROR(BN, BN_R_BIGNUM_TOO_LONG);
-    goto err;
+    return 0;
   }
 
   shift = 0;
   for (unsigned i = 0; i < num_iters; i++) {
     BN_ULONG both_odd = word_is_odd_mask(u->d[0]) & word_is_odd_mask(v->d[0]);
 
-    // If both |u| and |v| are odd, subtract the smaller from the larger.
+    // If both `u` and `v` are odd, subtract the smaller from the larger.
     BN_ULONG u_less_than_v =
         (BN_ULONG)0 - bn_sub_words(tmp->d, u->d, v->d, width);
     bn_select_words(u->d, both_odd & ~u_less_than_v, tmp->d, u->d, width);
     bn_sub_words(tmp->d, v->d, u->d, width);
     bn_select_words(v->d, both_odd & u_less_than_v, tmp->d, v->d, width);
 
-    // At least one of |u| and |v| is now even.
+    // At least one of `u` and `v` is now even.
     BN_ULONG u_is_odd = word_is_odd_mask(u->d[0]);
     BN_ULONG v_is_odd = word_is_odd_mask(v->d[0]);
     declassify_assert(!(u_is_odd & v_is_odd));
@@ -105,8 +106,8 @@ static int bn_gcd_consttime(BIGNUM *r, unsigned *out_shift, const BIGNUM *x,
     maybe_rshift1_words(v->d, ~v_is_odd, tmp->d, width);
   }
 
-  // One of |u| or |v| is zero at this point. The algorithm usually makes |u|
-  // zero, unless |y| was already zero on input. Fix this by combining the
+  // One of `u` or `v` is zero at this point. The algorithm usually makes `u`
+  // zero, unless `y` was already zero on input. Fix this by combining the
   // values.
   declassify_assert(BN_is_zero(u) | BN_is_zero(v));
   for (size_t i = 0; i < width; i++) {
@@ -114,11 +115,7 @@ static int bn_gcd_consttime(BIGNUM *r, unsigned *out_shift, const BIGNUM *x,
   }
 
   *out_shift = shift;
-  ret = bn_set_words(r, v->d, width);
-
-err:
-  BN_CTX_end(ctx);
-  return ret;
+  return bn_set_words(r, v->d, width);
 }
 
 int BN_gcd(BIGNUM *r, const BIGNUM *x, const BIGNUM *y, BN_CTX *ctx) {
@@ -126,17 +123,16 @@ int BN_gcd(BIGNUM *r, const BIGNUM *x, const BIGNUM *y, BN_CTX *ctx) {
   return bn_gcd_consttime(r, &shift, x, y, ctx) && BN_lshift(r, r, shift);
 }
 
-int bn_is_relatively_prime(int *out_relatively_prime, const BIGNUM *x,
-                           const BIGNUM *y, BN_CTX *ctx) {
-  int ret = 0;
-  BN_CTX_start(ctx);
+int bssl::bn_is_relatively_prime(int *out_relatively_prime, const BIGNUM *x,
+                                 const BIGNUM *y, BN_CTX *ctx) {
+  BN_CTXScope scope(ctx);
   unsigned shift;
   BIGNUM *gcd = BN_CTX_get(ctx);
-  if (gcd == NULL || !bn_gcd_consttime(gcd, &shift, x, y, ctx)) {
-    goto err;
+  if (gcd == nullptr || !bn_gcd_consttime(gcd, &shift, x, y, ctx)) {
+    return 0;
   }
 
-  // Check that 2^|shift| * |gcd| is one.
+  // Check that 2^`shift` * `gcd` is one.
   if (gcd->width == 0) {
     *out_relatively_prime = 0;
   } else {
@@ -146,29 +142,26 @@ int bn_is_relatively_prime(int *out_relatively_prime, const BIGNUM *x,
     }
     *out_relatively_prime = mask == 0;
   }
-  ret = 1;
 
-err:
-  BN_CTX_end(ctx);
-  return ret;
+  return 1;
 }
 
-int bn_lcm_consttime(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx) {
-  BN_CTX_start(ctx);
+int bssl::bn_lcm_consttime(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,
+                           BN_CTX *ctx) {
+  BN_CTXScope scope(ctx);
   unsigned shift;
   BIGNUM *gcd = BN_CTX_get(ctx);
-  int ret = gcd != NULL &&  //
-            bn_mul_consttime(r, a, b, ctx) &&
-            bn_gcd_consttime(gcd, &shift, a, b, ctx) &&
-            // |gcd| has a secret bit width.
-            bn_div_consttime(r, NULL, r, gcd, /*divisor_min_bits=*/0, ctx) &&
-            bn_rshift_secret_shift(r, r, shift, ctx);
-  BN_CTX_end(ctx);
-  return ret;
+  return gcd != nullptr &&  //
+         bn_mul_consttime(r, a, b, ctx) &&
+         bn_gcd_consttime(gcd, &shift, a, b, ctx) &&
+         // `gcd` has a secret bit width.
+         bn_div_consttime(r, nullptr, r, gcd, /*divisor_min_bits=*/0, ctx) &&
+         bn_rshift_secret_shift(r, r, shift, ctx);
 }
 
-int bn_mod_inverse_consttime(BIGNUM *r, int *out_no_inverse, const BIGNUM *a,
-                             const BIGNUM *n, BN_CTX *ctx) {
+int bssl::bn_mod_inverse_consttime(BIGNUM *r, int *out_no_inverse,
+                                   const BIGNUM *a, const BIGNUM *n,
+                                   BN_CTX *ctx) {
   *out_no_inverse = 0;
   if (BN_is_negative(a) || BN_ucmp(a, n) >= 0) {
     OPENSSL_PUT_ERROR(BN, BN_R_INPUT_NOT_REDUCED);
@@ -190,9 +183,9 @@ int bn_mod_inverse_consttime(BIGNUM *r, int *out_no_inverse, const BIGNUM *a,
   // negative numbers.
   //
   // For more details and proof of correctness, see
-  // https://github.com/mit-plv/fiat-crypto/pull/333. In particular, see |step|
-  // and |mod_inverse_consttime| for the algorithm in Gallina and see
-  // |mod_inverse_consttime_spec| for the correctness result.
+  // https://github.com/mit-plv/fiat-crypto/pull/333. In particular, see `step`
+  // and `mod_inverse_consttime` for the algorithm in Gallina and see
+  // `mod_inverse_consttime_spec` for the correctness result.
 
   if (!BN_is_odd(a) && !BN_is_odd(n)) {
     *out_no_inverse = 1;
@@ -200,15 +193,14 @@ int bn_mod_inverse_consttime(BIGNUM *r, int *out_no_inverse, const BIGNUM *a,
     return 0;
   }
 
-  // This function exists to compute the RSA private exponent, where |a| is one
-  // word. We'll thus use |a_width| when available.
+  // This function exists to compute the RSA private exponent, where `a` is one
+  // word. We'll thus use `a_width` when available.
   size_t n_width = n->width, a_width = a->width;
   if (a_width > n_width) {
     a_width = n_width;
   }
 
-  int ret = 0;
-  BN_CTX_start(ctx);
+  BN_CTXScope scope(ctx);
   BIGNUM *u = BN_CTX_get(ctx);
   BIGNUM *v = BN_CTX_get(ctx);
   BIGNUM *A = BN_CTX_get(ctx);
@@ -218,43 +210,43 @@ int bn_mod_inverse_consttime(BIGNUM *r, int *out_no_inverse, const BIGNUM *a,
   BIGNUM *tmp = BN_CTX_get(ctx);
   BIGNUM *tmp2 = BN_CTX_get(ctx);
   size_t a_bits, num_iters, n_bits;
-  if (u == NULL ||       //
-      v == NULL ||       //
-      A == NULL ||       //
-      B == NULL ||       //
-      C == NULL ||       //
-      D == NULL ||       //
-      tmp == NULL ||     //
-      tmp2 == NULL ||    //
+  if (u == nullptr ||       //
+      v == nullptr ||       //
+      A == nullptr ||       //
+      B == nullptr ||       //
+      C == nullptr ||       //
+      D == nullptr ||       //
+      tmp == nullptr ||     //
+      tmp2 == nullptr ||    //
       !BN_copy(u, a) ||  //
       !BN_copy(v, n) ||  //
       !BN_one(A) ||      //
       !BN_one(D) ||
-      // For convenience, size |u| and |v| equivalently.
+      // For convenience, size `u` and `v` equivalently.
       !bn_resize_words(u, n_width) ||  //
       !bn_resize_words(v, n_width) ||
-      // |A| and |C| are bounded by |m|.
+      // `A` and `C` are bounded by `m`.
       !bn_resize_words(A, n_width) ||  //
       !bn_resize_words(C, n_width) ||
-      // |B| and |D| are bounded by |a|.
+      // `B` and `D` are bounded by `a`.
       !bn_resize_words(B, a_width) ||  //
       !bn_resize_words(D, a_width) ||
-      // |tmp| and |tmp2| may be used at either size.
+      // `tmp` and `tmp2` may be used at either size.
       !bn_resize_words(tmp, n_width) ||  //
       !bn_resize_words(tmp2, n_width)) {
-    goto err;
+    return 0;
   }
 
-  // Each loop iteration halves at least one of |u| and |v|. Thus we need at
+  // Each loop iteration halves at least one of `u` and `v`. Thus we need at
   // most the combined bit width of inputs for at least one value to be zero.
-  // |a_bits| and |n_bits| cannot overflow because |bn_wexpand| ensures bit
-  // counts fit in even |int|.
+  // `a_bits` and `n_bits` cannot overflow because `bn_wexpand` ensures bit
+  // counts fit in even `int`.
   a_bits = a_width * BN_BITS2;
   n_bits = n_width * BN_BITS2;
   num_iters = a_bits + n_bits;
   if (num_iters < a_bits) {
     OPENSSL_PUT_ERROR(BN, BN_R_BIGNUM_TOO_LONG);
-    goto err;
+    return 0;
   }
 
   // Before and after each loop iteration, the following hold:
@@ -273,7 +265,7 @@ int bn_mod_inverse_consttime(BIGNUM *r, int *out_no_inverse, const BIGNUM *a,
   for (size_t i = 0; i < num_iters; i++) {
     BN_ULONG both_odd = word_is_odd_mask(u->d[0]) & word_is_odd_mask(v->d[0]);
 
-    // If both |u| and |v| are odd, subtract the smaller from the larger.
+    // If both `u` and `v` are odd, subtract the smaller from the larger.
     BN_ULONG v_less_than_u =
         (BN_ULONG)0 - bn_sub_words(tmp->d, v->d, u->d, n_width);
     bn_select_words(v->d, both_odd & ~v_less_than_u, tmp->d, v->d, n_width);
@@ -293,8 +285,8 @@ int bn_mod_inverse_consttime(BIGNUM *r, int *out_no_inverse, const BIGNUM *a,
     bn_select_words(B->d, both_odd & v_less_than_u, tmp->d, B->d, a_width);
     bn_select_words(D->d, both_odd & ~v_less_than_u, tmp->d, D->d, a_width);
 
-    // Our loop invariants hold at this point. Additionally, exactly one of |u|
-    // and |v| is now even.
+    // Our loop invariants hold at this point. Additionally, exactly one of `u`
+    // and `v` is now even.
     BN_ULONG u_is_even = ~word_is_odd_mask(u->d[0]);
     BN_ULONG v_is_even = ~word_is_odd_mask(v->d[0]);
     declassify_assert(u_is_even != v_is_even);
@@ -328,12 +320,8 @@ int bn_mod_inverse_consttime(BIGNUM *r, int *out_no_inverse, const BIGNUM *a,
   if (constant_time_declassify_int(!BN_is_one(u))) {
     *out_no_inverse = 1;
     OPENSSL_PUT_ERROR(BN, BN_R_NO_INVERSE);
-    goto err;
+    return 0;
   }
 
-  ret = BN_copy(r, A) != NULL;
-
-err:
-  BN_CTX_end(ctx);
-  return ret;
+  return BN_copy(r, A) != nullptr;
 }