grpc 1.84.0 → 1.85.0.pre1

data/third_party/boringssl-with-bazel/crypto/x509/x509name.cc

@@ -26,12 +26,14 @@
 #include "internal.h"
 
 
+using namespace bssl;
+
 int X509_NAME_get_text_by_NID(const X509_NAME *name, int nid, char *buf,
                               int len) {
   const ASN1_OBJECT *obj;
 
   obj = OBJ_nid2obj(nid);
-  if (obj == NULL) {
+  if (obj == nullptr) {
     return -1;
   }
   return (X509_NAME_get_text_by_OBJ(name, obj, buf, len));
@@ -45,7 +47,7 @@ int X509_NAME_get_text_by_OBJ(const X509_NAME *name, const ASN1_OBJECT *obj,
   }
   const ASN1_STRING *data =
       X509_NAME_ENTRY_get_data(X509_NAME_get_entry(name, i));
-  unsigned char *text = NULL;
+  unsigned char *text = nullptr;
   int ret = -1;
   int text_len = ASN1_STRING_to_UTF8(&text, data);
   // Fail if we could not encode as UTF-8.
@@ -54,13 +56,13 @@ int X509_NAME_get_text_by_OBJ(const X509_NAME *name, const ASN1_OBJECT *obj,
   }
   CBS cbs;
   CBS_init(&cbs, text, text_len);
-  // Fail if the UTF-8 encoding constains a 0 byte because this is
-  // returned as a C string and callers very often do not check.
+  // Fail if the UTF-8 encoding contains a 0 byte because this is returned as a
+  // C string and callers very often do not check.
   if (CBS_contains_zero_byte(&cbs)) {
     goto out;
   }
   // We still support the "pass NULL to find out how much" API
-  if (buf != NULL) {
+  if (buf != nullptr) {
     if (text_len >= len || len <= 0 ||
         !CBS_copy_bytes(&cbs, (uint8_t *)buf, text_len)) {
       goto out;
@@ -76,32 +78,34 @@ out:
 }
 
 int X509_NAME_entry_count(const X509_NAME *name) {
-  if (name == NULL) {
+  if (name == nullptr) {
     return 0;
   }
-  return (int)sk_X509_NAME_ENTRY_num(name->entries);
+  const auto *impl = FromOpaque(name);
+  return (int)sk_X509_NAME_ENTRY_num(impl->entries);
 }
 
 int X509_NAME_get_index_by_NID(const X509_NAME *name, int nid, int lastpos) {
   const ASN1_OBJECT *obj;
 
   obj = OBJ_nid2obj(nid);
-  if (obj == NULL) {
+  if (obj == nullptr) {
     return -2;
   }
   return X509_NAME_get_index_by_OBJ(name, obj, lastpos);
 }
 
-// NOTE: you should be passsing -1, not 0 as lastpos
+// NOTE: you should be passing -1, not 0 as lastpos
 int X509_NAME_get_index_by_OBJ(const X509_NAME *name, const ASN1_OBJECT *obj,
                                int lastpos) {
-  if (name == NULL) {
+  if (name == nullptr) {
     return -1;
   }
+  const auto *impl = FromOpaque(name);
   if (lastpos < 0) {
     lastpos = -1;
   }
-  const STACK_OF(X509_NAME_ENTRY) *sk = name->entries;
+  const STACK_OF(X509_NAME_ENTRY) *sk = impl->entries;
   int n = (int)sk_X509_NAME_ENTRY_num(sk);
   for (lastpos++; lastpos < n; lastpos++) {
     const X509_NAME_ENTRY *ne = sk_X509_NAME_ENTRY_value(sk, lastpos);
@@ -113,24 +117,30 @@ int X509_NAME_get_index_by_OBJ(const X509_NAME *name, const ASN1_OBJECT *obj,
 }
 
 X509_NAME_ENTRY *X509_NAME_get_entry(const X509_NAME *name, int loc) {
-  if (name == NULL || loc < 0 ||
-      sk_X509_NAME_ENTRY_num(name->entries) <= (size_t)loc) {
-    return NULL;
+  if (name == nullptr) {
+    return nullptr;
+  }
+  const auto *impl = FromOpaque(name);
+  if (loc < 0 || sk_X509_NAME_ENTRY_num(impl->entries) <= (size_t)loc) {
+    return nullptr;
   } else {
-    return (sk_X509_NAME_ENTRY_value(name->entries, loc));
+    return (sk_X509_NAME_ENTRY_value(impl->entries, loc));
   }
 }
 
 X509_NAME_ENTRY *X509_NAME_delete_entry(X509_NAME *name, int loc) {
-  if (name == NULL || loc < 0 ||
-      sk_X509_NAME_ENTRY_num(name->entries) <= (size_t)loc) {
-    return NULL;
+  if (name == nullptr) {
+    return nullptr;
+  }
+  const auto *impl = FromOpaque(name);
+  if (loc < 0 || sk_X509_NAME_ENTRY_num(impl->entries) <= (size_t)loc) {
+    return nullptr;
   }
 
-  STACK_OF(X509_NAME_ENTRY) *sk = name->entries;
+  STACK_OF(X509_NAME_ENTRY) *sk = impl->entries;
   X509_NAME_ENTRY *ret = sk_X509_NAME_ENTRY_delete(sk, loc);
   size_t n = sk_X509_NAME_ENTRY_num(sk);
-  name->modified = 1;
+  x509_name_invalidate_cache(name);
   if ((size_t)loc == n) {
     return ret;
   }
@@ -157,7 +167,7 @@ int X509_NAME_add_entry_by_OBJ(X509_NAME *name, const ASN1_OBJECT *obj,
                                int type, const unsigned char *bytes,
                                ossl_ssize_t len, int loc, int set) {
   X509_NAME_ENTRY *ne =
-      X509_NAME_ENTRY_create_by_OBJ(NULL, obj, type, bytes, len);
+      X509_NAME_ENTRY_create_by_OBJ(nullptr, obj, type, bytes, len);
   if (!ne) {
     return 0;
   }
@@ -170,7 +180,7 @@ int X509_NAME_add_entry_by_NID(X509_NAME *name, int nid, int type,
                                const unsigned char *bytes, ossl_ssize_t len,
                                int loc, int set) {
   X509_NAME_ENTRY *ne =
-      X509_NAME_ENTRY_create_by_NID(NULL, nid, type, bytes, len);
+      X509_NAME_ENTRY_create_by_NID(nullptr, nid, type, bytes, len);
   if (!ne) {
     return 0;
   }
@@ -183,7 +193,7 @@ int X509_NAME_add_entry_by_txt(X509_NAME *name, const char *field, int type,
                                const unsigned char *bytes, ossl_ssize_t len,
                                int loc, int set) {
   X509_NAME_ENTRY *ne =
-      X509_NAME_ENTRY_create_by_txt(NULL, field, type, bytes, len);
+      X509_NAME_ENTRY_create_by_txt(nullptr, field, type, bytes, len);
   if (!ne) {
     return 0;
   }
@@ -196,14 +206,18 @@ int X509_NAME_add_entry_by_txt(X509_NAME *name, const char *field, int type,
 // guy we are about to stomp on.
 int X509_NAME_add_entry(X509_NAME *name, const X509_NAME_ENTRY *entry, int loc,
                         int set) {
-  X509_NAME_ENTRY *new_name = NULL;
-  int i, inc;
-  STACK_OF(X509_NAME_ENTRY) *sk;
-
-  if (name == NULL) {
+  if (name == nullptr) {
     return 0;
   }
-  sk = name->entries;
+  auto *impl = FromOpaque(name);
+  if (impl->entries == nullptr) {
+    impl->entries = sk_X509_NAME_ENTRY_new_null();
+    if (impl->entries == nullptr) {
+      return 0;
+    }
+  }
+
+  STACK_OF(X509_NAME_ENTRY) *sk = impl->entries;
   int n = (int)sk_X509_NAME_ENTRY_num(sk);
   if (loc > n) {
     loc = n;
@@ -211,8 +225,8 @@ int X509_NAME_add_entry(X509_NAME *name, const X509_NAME_ENTRY *entry, int loc,
     loc = n;
   }
 
-  inc = (set == 0);
-  name->modified = 1;
+  bool inc = set == 0;
+  x509_name_invalidate_cache(name);
 
   if (set == -1) {
     if (loc == 0) {
@@ -222,7 +236,6 @@ int X509_NAME_add_entry(X509_NAME *name, const X509_NAME_ENTRY *entry, int loc,
       set = sk_X509_NAME_ENTRY_value(sk, loc - 1)->set;
     }
   } else {  // if (set >= 0)
-
     if (loc >= n) {
       if (loc != 0) {
         set = sk_X509_NAME_ENTRY_value(sk, loc - 1)->set + 1;
@@ -234,25 +247,22 @@ int X509_NAME_add_entry(X509_NAME *name, const X509_NAME_ENTRY *entry, int loc,
     }
   }
 
-  if ((new_name = X509_NAME_ENTRY_dup(entry)) == NULL) {
-    goto err;
+  UniquePtr<X509_NAME_ENTRY> new_entry(X509_NAME_ENTRY_dup(entry));
+  if (new_entry == nullptr) {
+    return 0;
   }
-  new_name->set = set;
-  if (!sk_X509_NAME_ENTRY_insert(sk, new_name, loc)) {
-    goto err;
+  new_entry->set = set;
+  if (!sk_X509_NAME_ENTRY_insert(sk, new_entry.get(), loc)) {
+    return 0;
   }
+  new_entry.release(); // `sk` took ownership.
   if (inc) {
     n = (int)sk_X509_NAME_ENTRY_num(sk);
-    for (i = loc + 1; i < n; i++) {
+    for (int i = loc + 1; i < n; i++) {
       sk_X509_NAME_ENTRY_value(sk, i)->set += 1;
     }
   }
   return 1;
-err:
-  if (new_name != NULL) {
-    X509_NAME_ENTRY_free(new_name);
-  }
-  return 0;
 }
 
 X509_NAME_ENTRY *X509_NAME_ENTRY_create_by_txt(X509_NAME_ENTRY **ne,
@@ -263,10 +273,10 @@ X509_NAME_ENTRY *X509_NAME_ENTRY_create_by_txt(X509_NAME_ENTRY **ne,
   X509_NAME_ENTRY *nentry;
 
   obj = OBJ_txt2obj(field, 0);
-  if (obj == NULL) {
+  if (obj == nullptr) {
     OPENSSL_PUT_ERROR(X509, X509_R_INVALID_FIELD_NAME);
     ERR_add_error_data(2, "name=", field);
-    return NULL;
+    return nullptr;
   }
   nentry = X509_NAME_ENTRY_create_by_OBJ(ne, obj, type, bytes, len);
   ASN1_OBJECT_free(obj);
@@ -278,9 +288,9 @@ X509_NAME_ENTRY *X509_NAME_ENTRY_create_by_NID(X509_NAME_ENTRY **ne, int nid,
                                                const unsigned char *bytes,
                                                ossl_ssize_t len) {
   const ASN1_OBJECT *obj = OBJ_nid2obj(nid);
-  if (obj == NULL) {
+  if (obj == nullptr) {
     OPENSSL_PUT_ERROR(X509, X509_R_UNKNOWN_NID);
-    return NULL;
+    return nullptr;
   }
   return X509_NAME_ENTRY_create_by_OBJ(ne, obj, type, bytes, len);
 }
@@ -291,9 +301,9 @@ X509_NAME_ENTRY *X509_NAME_ENTRY_create_by_OBJ(X509_NAME_ENTRY **ne,
                                                ossl_ssize_t len) {
   X509_NAME_ENTRY *ret;
 
-  if ((ne == NULL) || (*ne == NULL)) {
-    if ((ret = X509_NAME_ENTRY_new()) == NULL) {
-      return NULL;
+  if ((ne == nullptr) || (*ne == nullptr)) {
+    if ((ret = X509_NAME_ENTRY_new()) == nullptr) {
+      return nullptr;
     }
   } else {
     ret = *ne;
@@ -306,60 +316,60 @@ X509_NAME_ENTRY *X509_NAME_ENTRY_create_by_OBJ(X509_NAME_ENTRY **ne,
     goto err;
   }
 
-  if ((ne != NULL) && (*ne == NULL)) {
+  if ((ne != nullptr) && (*ne == nullptr)) {
     *ne = ret;
   }
   return ret;
 err:
-  if ((ne == NULL) || (ret != *ne)) {
+  if ((ne == nullptr) || (ret != *ne)) {
     X509_NAME_ENTRY_free(ret);
   }
-  return NULL;
+  return nullptr;
 }
 
 int X509_NAME_ENTRY_set_object(X509_NAME_ENTRY *ne, const ASN1_OBJECT *obj) {
-  if ((ne == NULL) || (obj == NULL)) {
+  if ((ne == nullptr) || (obj == nullptr)) {
     OPENSSL_PUT_ERROR(X509, ERR_R_PASSED_NULL_PARAMETER);
     return 0;
   }
   ASN1_OBJECT_free(ne->object);
   ne->object = OBJ_dup(obj);
-  return ((ne->object == NULL) ? 0 : 1);
+  return ((ne->object == nullptr) ? 0 : 1);
 }
 
 int X509_NAME_ENTRY_set_data(X509_NAME_ENTRY *ne, int type,
                              const unsigned char *bytes, ossl_ssize_t len) {
-  if ((ne == NULL) || ((bytes == NULL) && (len != 0))) {
+  if ((ne == nullptr) || ((bytes == nullptr) && (len != 0))) {
     return 0;
   }
   if ((type > 0) && (type & MBSTRING_FLAG)) {
-    return ASN1_STRING_set_by_NID(&ne->value, bytes, len, type,
-                                  OBJ_obj2nid(ne->object))
-               ? 1
-               : 0;
+    ASN1_STRING *dst = &ne->value;
+    return ASN1_STRING_set_by_NID(&dst, bytes, len, type,
+                                  OBJ_obj2nid(ne->object)) != nullptr;
   }
   if (len < 0) {
     len = strlen((const char *)bytes);
   }
-  if (!ASN1_STRING_set(ne->value, bytes, len)) {
+  if (!ASN1_STRING_set(&ne->value, bytes, len)) {
     return 0;
   }
   if (type != V_ASN1_UNDEF) {
-    ne->value->type = type;
+    ne->value.type = type;
   }
   return 1;
 }
 
 ASN1_OBJECT *X509_NAME_ENTRY_get_object(const X509_NAME_ENTRY *ne) {
-  if (ne == NULL) {
-    return NULL;
+  if (ne == nullptr) {
+    return nullptr;
   }
   return ne->object;
 }
 
 ASN1_STRING *X509_NAME_ENTRY_get_data(const X509_NAME_ENTRY *ne) {
-  if (ne == NULL) {
-    return NULL;
+  if (ne == nullptr) {
+    return nullptr;
   }
-  return ne->value;
+  // This function is not const-correct for OpenSSL compatibility.
+  return const_cast<ASN1_STRING*>(&ne->value);
 }

data/third_party/boringssl-with-bazel/crypto/x509/x509rset.cc

@@ -21,7 +21,7 @@
 
 
 int X509_REQ_set_version(X509_REQ *x, long version) {
-  if (x == NULL) {
+  if (x == nullptr) {
     return 0;
   }
   if (version != X509_REQ_VERSION_1) {
@@ -32,36 +32,24 @@ int X509_REQ_set_version(X509_REQ *x, long version) {
 }
 
 int X509_REQ_set_subject_name(X509_REQ *x, X509_NAME *name) {
-  if ((x == NULL) || (x->req_info == NULL)) {
+  if ((x == nullptr) || (x->req_info == nullptr)) {
     return 0;
   }
   return (X509_NAME_set(&x->req_info->subject, name));
 }
 
 int X509_REQ_set_pubkey(X509_REQ *x, EVP_PKEY *pkey) {
-  if ((x == NULL) || (x->req_info == NULL)) {
+  if ((x == nullptr) || (x->req_info == nullptr)) {
     return 0;
   }
   return (X509_PUBKEY_set(&x->req_info->pubkey, pkey));
 }
 
 int X509_REQ_set1_signature_algo(X509_REQ *req, const X509_ALGOR *algo) {
-  X509_ALGOR *copy = X509_ALGOR_dup(algo);
-  if (copy == NULL) {
-    return 0;
-  }
-
-  X509_ALGOR_free(req->sig_alg);
-  req->sig_alg = copy;
-  return 1;
+  return X509_ALGOR_copy(req->sig_alg, algo);
 }
 
 int X509_REQ_set1_signature_value(X509_REQ *req, const uint8_t *sig,
                                   size_t sig_len) {
-  if (!ASN1_STRING_set(req->signature, sig, sig_len)) {
-    return 0;
-  }
-  req->signature->flags &= ~(ASN1_STRING_FLAG_BITS_LEFT | 0x07);
-  req->signature->flags |= ASN1_STRING_FLAG_BITS_LEFT;
-  return 1;
+  return ASN1_STRING_set(req->signature, sig, sig_len);
 }

data/third_party/boringssl-with-bazel/crypto/x509/x509spki.cc

@@ -20,15 +20,15 @@
 #include <openssl/x509.h>
 
 int NETSCAPE_SPKI_set_pubkey(NETSCAPE_SPKI *x, EVP_PKEY *pkey) {
-  if ((x == NULL) || (x->spkac == NULL)) {
+  if ((x == nullptr) || (x->spkac == nullptr)) {
     return 0;
   }
   return (X509_PUBKEY_set(&(x->spkac->pubkey), pkey));
 }
 
 EVP_PKEY *NETSCAPE_SPKI_get_pubkey(const NETSCAPE_SPKI *x) {
-  if ((x == NULL) || (x->spkac == NULL)) {
-    return NULL;
+  if ((x == nullptr) || (x->spkac == nullptr)) {
+    return nullptr;
   }
   return (X509_PUBKEY_get(x->spkac->pubkey));
 }
@@ -45,19 +45,19 @@ NETSCAPE_SPKI *NETSCAPE_SPKI_b64_decode(const char *str, ossl_ssize_t len) {
   }
   if (!EVP_DecodedLength(&spki_len, len)) {
     OPENSSL_PUT_ERROR(X509, X509_R_BASE64_DECODE_ERROR);
-    return NULL;
+    return nullptr;
   }
   if (!(spki_der = reinterpret_cast<uint8_t *>(OPENSSL_malloc(spki_len)))) {
-    return NULL;
+    return nullptr;
   }
   if (!EVP_DecodeBase64(spki_der, &spki_len, spki_len, (const uint8_t *)str,
                         len)) {
     OPENSSL_PUT_ERROR(X509, X509_R_BASE64_DECODE_ERROR);
     OPENSSL_free(spki_der);
-    return NULL;
+    return nullptr;
   }
   p = spki_der;
-  spki = d2i_NETSCAPE_SPKI(NULL, &p, spki_len);
+  spki = d2i_NETSCAPE_SPKI(nullptr, &p, spki_len);
   OPENSSL_free(spki_der);
   return spki;
 }
@@ -69,19 +69,19 @@ char *NETSCAPE_SPKI_b64_encode(NETSCAPE_SPKI *spki) {
   char *b64_str;
   size_t b64_len;
   int der_len;
-  der_len = i2d_NETSCAPE_SPKI(spki, NULL);
+  der_len = i2d_NETSCAPE_SPKI(spki, nullptr);
   if (!EVP_EncodedLength(&b64_len, der_len)) {
     OPENSSL_PUT_ERROR(X509, ERR_R_OVERFLOW);
-    return NULL;
+    return nullptr;
   }
   der_spki = reinterpret_cast<uint8_t *>(OPENSSL_malloc(der_len));
-  if (der_spki == NULL) {
-    return NULL;
+  if (der_spki == nullptr) {
+    return nullptr;
   }
   b64_str = reinterpret_cast<char *>(OPENSSL_malloc(b64_len));
-  if (b64_str == NULL) {
+  if (b64_str == nullptr) {
     OPENSSL_free(der_spki);
-    return NULL;
+    return nullptr;
   }
   p = der_spki;
   i2d_NETSCAPE_SPKI(spki, &p);

data/third_party/boringssl-with-bazel/crypto/x509/x_algor.cc

@@ -17,29 +17,143 @@
 #include <openssl/asn1.h>
 #include <openssl/asn1t.h>
 #include <openssl/digest.h>
+#include <openssl/err.h>
 #include <openssl/obj.h>
+#include <openssl/mem.h>
 
 #include "../asn1/internal.h"
+#include "../bytestring/internal.h"
+#include "../internal.h"
+#include "../mem_internal.h"
 #include "internal.h"
 
 
-ASN1_SEQUENCE(X509_ALGOR) = {
-    ASN1_SIMPLE(X509_ALGOR, algorithm, ASN1_OBJECT),
-    ASN1_OPT(X509_ALGOR, parameter, ASN1_ANY),
-} ASN1_SEQUENCE_END(X509_ALGOR)
+using namespace bssl;
 
-IMPLEMENT_ASN1_FUNCTIONS_const(X509_ALGOR)
-IMPLEMENT_ASN1_DUP_FUNCTION_const(X509_ALGOR)
+void bssl::x509_algor_init(X509_ALGOR *alg) {
+  OPENSSL_memset(alg, 0, sizeof(X509_ALGOR));
+  alg->algorithm = const_cast<ASN1_OBJECT *>(OBJ_get_undef());
+}
+
+void bssl::x509_algor_cleanup(X509_ALGOR *alg) {
+  ASN1_OBJECT_free(alg->algorithm);
+  ASN1_TYPE_free(alg->parameter);
+}
+
+X509_ALGOR *X509_ALGOR_new() {
+  UniquePtr<X509_ALGOR> ret = MakeUnique<X509_ALGOR>();
+  if (ret == nullptr) {
+    return nullptr;
+  }
+  x509_algor_init(ret.get());
+  return ret.release();
+}
+
+void X509_ALGOR_free(X509_ALGOR *alg) {
+  if (alg != nullptr) {
+    x509_algor_cleanup(alg);
+    OPENSSL_free(alg);
+  }
+}
+
+int bssl::x509_parse_algorithm(CBS *cbs, X509_ALGOR *out) {
+  CBS seq;
+  if (!CBS_get_asn1(cbs, &seq, CBS_ASN1_SEQUENCE)) {
+    OPENSSL_PUT_ERROR(ASN1, ASN1_R_DECODE_ERROR);
+    return 0;
+  }
+
+  UniquePtr<ASN1_OBJECT> obj(asn1_parse_object(&seq, /*tag=*/0));
+  if (obj == nullptr) {
+    return 0;
+  }
+  ASN1_OBJECT_free(out->algorithm);
+  out->algorithm = obj.release();
+  if (CBS_len(&seq) == 0) {
+    ASN1_TYPE_free(out->parameter);
+    out->parameter = nullptr;
+  } else {
+    if (out->parameter == nullptr) {
+      out->parameter = ASN1_TYPE_new();
+    }
+    if (out->parameter == nullptr ||  //
+        !asn1_parse_any(&seq, out->parameter)) {
+      return 0;
+    }
+  }
+  if (CBS_len(&seq) != 0) {
+    OPENSSL_PUT_ERROR(ASN1, ASN1_R_DECODE_ERROR);
+    return 0;
+  }
+  return 1;
+}
+
+int bssl::x509_marshal_algorithm(CBB *out, const X509_ALGOR *in) {
+  CBB seq;
+  return CBB_add_asn1(out, &seq, CBS_ASN1_SEQUENCE) &&
+         asn1_marshal_object(&seq, in->algorithm, /*tag=*/0) &&
+         (in->parameter == nullptr || asn1_marshal_any(&seq, in->parameter)) &&
+         CBB_flush(out);
+}
+
+X509_ALGOR *d2i_X509_ALGOR(X509_ALGOR **out, const uint8_t **inp, long len) {
+  return D2IFromCBS(out, inp, len, [](CBS *cbs) -> UniquePtr<X509_ALGOR> {
+    UniquePtr<X509_ALGOR> ret(X509_ALGOR_new());
+    if (ret == nullptr || !x509_parse_algorithm(cbs, ret.get())) {
+      return nullptr;
+    }
+    return ret;
+  });
+}
+
+int i2d_X509_ALGOR(const X509_ALGOR *in, uint8_t **outp) {
+  return I2DFromCBB(/*initial_capacity=*/32, outp, [&](CBB *cbb) -> bool {
+    return x509_marshal_algorithm(cbb, in);
+  });
+}
+
+IMPLEMENT_EXTERN_ASN1_PARSE_INTO(X509_ALGOR, X509_ALGOR_new, X509_ALGOR_free,
+                                 CBS_ASN1_SEQUENCE, x509_parse_algorithm,
+                                 x509_marshal_algorithm)
+
+X509_ALGOR *X509_ALGOR_dup(const X509_ALGOR *alg) {
+  UniquePtr<X509_ALGOR> copy(X509_ALGOR_new());
+  if (copy == nullptr || !X509_ALGOR_copy(copy.get(), alg)) {
+    return nullptr;
+  }
+  return copy.release();
+}
+
+int X509_ALGOR_copy(X509_ALGOR *dst, const X509_ALGOR *src) {
+  UniquePtr<ASN1_OBJECT> algorithm(OBJ_dup(src->algorithm));
+  if (algorithm == nullptr) {
+    return 0;
+  }
+  UniquePtr<ASN1_TYPE> parameter;
+  if (src->parameter != nullptr) {
+    parameter.reset(ASN1_TYPE_new());
+    if (parameter == nullptr ||
+        !ASN1_TYPE_set1(parameter.get(), src->parameter->type,
+                        asn1_type_value_as_pointer(src->parameter))) {
+      return 0;
+    }
+  }
+  ASN1_OBJECT_free(dst->algorithm);
+  dst->algorithm = algorithm.release();
+  ASN1_TYPE_free(dst->parameter);
+  dst->parameter = parameter.release();
+  return 1;
+}
 
 int X509_ALGOR_set0(X509_ALGOR *alg, ASN1_OBJECT *aobj, int ptype, void *pval) {
   if (!alg) {
     return 0;
   }
   if (ptype != V_ASN1_UNDEF) {
-    if (alg->parameter == NULL) {
+    if (alg->parameter == nullptr) {
       alg->parameter = ASN1_TYPE_new();
     }
-    if (alg->parameter == NULL) {
+    if (alg->parameter == nullptr) {
       return 0;
     }
   }
@@ -53,7 +167,7 @@ int X509_ALGOR_set0(X509_ALGOR *alg, ASN1_OBJECT *aobj, int ptype, void *pval) {
   if (ptype == V_ASN1_UNDEF) {
     if (alg->parameter) {
       ASN1_TYPE_free(alg->parameter);
-      alg->parameter = NULL;
+      alg->parameter = nullptr;
     }
   } else {
     ASN1_TYPE_set(alg->parameter, ptype, pval);
@@ -63,18 +177,18 @@ int X509_ALGOR_set0(X509_ALGOR *alg, ASN1_OBJECT *aobj, int ptype, void *pval) {
 
 void X509_ALGOR_get0(const ASN1_OBJECT **out_obj, int *out_param_type,
                      const void **out_param_value, const X509_ALGOR *alg) {
-  if (out_obj != NULL) {
+  if (out_obj != nullptr) {
     *out_obj = alg->algorithm;
   }
-  if (out_param_type != NULL) {
+  if (out_param_type != nullptr) {
     int type = V_ASN1_UNDEF;
-    const void *value = NULL;
-    if (alg->parameter != NULL) {
+    const void *value = nullptr;
+    if (alg->parameter != nullptr) {
       type = alg->parameter->type;
       value = asn1_type_value_as_pointer(alg->parameter);
     }
     *out_param_type = type;
-    if (out_param_value != NULL) {
+    if (out_param_value != nullptr) {
       *out_param_value = value;
     }
   }
@@ -91,10 +205,11 @@ int X509_ALGOR_set_md(X509_ALGOR *alg, const EVP_MD *md) {
     param_type = V_ASN1_NULL;
   }
 
-  return X509_ALGOR_set0(alg, OBJ_nid2obj(EVP_MD_type(md)), param_type, NULL);
+  return X509_ALGOR_set0(alg, OBJ_nid2obj(EVP_MD_type(md)), param_type,
+                         nullptr);
 }
 
-// X509_ALGOR_cmp returns 0 if |a| and |b| are equal and non-zero otherwise.
+// X509_ALGOR_cmp returns 0 if `a` and `b` are equal and non-zero otherwise.
 int X509_ALGOR_cmp(const X509_ALGOR *a, const X509_ALGOR *b) {
   int rv;
   rv = OBJ_cmp(a->algorithm, b->algorithm);
@@ -106,11 +221,3 @@ int X509_ALGOR_cmp(const X509_ALGOR *a, const X509_ALGOR *b) {
   }
   return ASN1_TYPE_cmp(a->parameter, b->parameter);
 }
-
-int x509_marshal_algorithm(CBB *out, const X509_ALGOR *in) {
-  uint8_t *ptr;
-  int len = i2d_X509_ALGOR(in, NULL);
-  return len > 0 &&  //
-         CBB_add_space(out, &ptr, static_cast<size_t>(len)) &&
-         i2d_X509_ALGOR(in, &ptr) == len;
-}