@fails-components/webtransport 0.0.1-rc.2 → 0.0.1

package/third_party/boringssl/src/crypto/x509/algorithm.c

@@ -64,6 +64,15 @@
 
 #include "internal.h"
 
+/* Restrict the digests that are allowed in X509 certificates */
+static int x509_digest_nid_ok(const int digest_nid) {
+  switch (digest_nid) {
+    case NID_md4:
+    case NID_md5:
+      return 0;
+  }
+  return 1;
+}
 
 int x509_digest_sign_algorithm(EVP_MD_CTX *ctx, X509_ALGOR *algor) {
   EVP_PKEY *pkey = EVP_PKEY_CTX_get0_pkey(ctx->pctx);
@@ -95,8 +104,10 @@ int x509_digest_sign_algorithm(EVP_MD_CTX *ctx, X509_ALGOR *algor) {
     return 0;
   }
 
+  const int digest_nid = EVP_MD_type(digest);
   int sign_nid;
-  if (!OBJ_find_sigid_by_algs(&sign_nid, EVP_MD_type(digest),
+  if (!x509_digest_nid_ok(digest_nid) ||
+      !OBJ_find_sigid_by_algs(&sign_nid, digest_nid,
                               EVP_PKEY_id(pkey))) {
     OPENSSL_PUT_ERROR(ASN1, ASN1_R_DIGEST_AND_KEY_TYPE_NOT_SUPPORTED);
     return 0;
@@ -126,6 +137,12 @@ int x509_digest_verify_init(EVP_MD_CTX *ctx, const X509_ALGOR *sigalg,
     return 0;
   }
 
+  /* Check for permitted digest algorithms */
+  if (!x509_digest_nid_ok(digest_nid)) {
+    OPENSSL_PUT_ERROR(ASN1, ASN1_R_DIGEST_AND_KEY_TYPE_NOT_SUPPORTED);
+    return 0;
+  }
+
   /* NID_undef signals that there are custom parameters to set. */
   if (digest_nid == NID_undef) {
     if (sigalg_nid == NID_rsassaPss) {

package/third_party/boringssl/src/crypto/x509/x_algor.c

@@ -66,7 +66,7 @@
 
 ASN1_SEQUENCE(X509_ALGOR) = {
         ASN1_SIMPLE(X509_ALGOR, algorithm, ASN1_OBJECT),
-        ASN1_OPT(X509_ALGOR, parameter, ASN1_ANY)
+        ASN1_OPT(X509_ALGOR, parameter, ASN1_ANY),
 } ASN1_SEQUENCE_END(X509_ALGOR)
 
 ASN1_ITEM_TEMPLATE(X509_ALGORS) =

package/third_party/boringssl/src/crypto/x509/x_crl.c

@@ -74,7 +74,7 @@ static int setup_idp(X509_CRL *crl, ISSUING_DIST_POINT *idp);
 ASN1_SEQUENCE(X509_REVOKED) = {
         ASN1_SIMPLE(X509_REVOKED,serialNumber, ASN1_INTEGER),
         ASN1_SIMPLE(X509_REVOKED,revocationDate, ASN1_TIME),
-        ASN1_SEQUENCE_OF_OPT(X509_REVOKED,extensions, X509_EXTENSION)
+        ASN1_SEQUENCE_OF_OPT(X509_REVOKED,extensions, X509_EXTENSION),
 } ASN1_SEQUENCE_END(X509_REVOKED)
 
 static int crl_lookup(X509_CRL *crl, X509_REVOKED **ret, ASN1_INTEGER *serial,
@@ -112,7 +112,7 @@ ASN1_SEQUENCE_enc(X509_CRL_INFO, enc, crl_inf_cb) = {
         ASN1_SIMPLE(X509_CRL_INFO, lastUpdate, ASN1_TIME),
         ASN1_OPT(X509_CRL_INFO, nextUpdate, ASN1_TIME),
         ASN1_SEQUENCE_OF_OPT(X509_CRL_INFO, revoked, X509_REVOKED),
-        ASN1_EXP_SEQUENCE_OF_OPT(X509_CRL_INFO, extensions, X509_EXTENSION, 0)
+        ASN1_EXP_SEQUENCE_OF_OPT(X509_CRL_INFO, extensions, X509_EXTENSION, 0),
 } ASN1_SEQUENCE_END_enc(X509_CRL_INFO, X509_CRL_INFO)
 
 /*
@@ -356,7 +356,7 @@ static int setup_idp(X509_CRL *crl, ISSUING_DIST_POINT *idp)
 ASN1_SEQUENCE_ref(X509_CRL, crl_cb) = {
         ASN1_SIMPLE(X509_CRL, crl, X509_CRL_INFO),
         ASN1_SIMPLE(X509_CRL, sig_alg, X509_ALGOR),
-        ASN1_SIMPLE(X509_CRL, signature, ASN1_BIT_STRING)
+        ASN1_SIMPLE(X509_CRL, signature, ASN1_BIT_STRING),
 } ASN1_SEQUENCE_END_ref(X509_CRL, X509_CRL)
 
 IMPLEMENT_ASN1_FUNCTIONS(X509_REVOKED)

package/third_party/boringssl/src/crypto/x509/x_exten.c

@@ -65,7 +65,7 @@
 ASN1_SEQUENCE(X509_EXTENSION) = {
         ASN1_SIMPLE(X509_EXTENSION, object, ASN1_OBJECT),
         ASN1_OPT(X509_EXTENSION, critical, ASN1_BOOLEAN),
-        ASN1_SIMPLE(X509_EXTENSION, value, ASN1_OCTET_STRING)
+        ASN1_SIMPLE(X509_EXTENSION, value, ASN1_OCTET_STRING),
 } ASN1_SEQUENCE_END(X509_EXTENSION)
 
 ASN1_ITEM_TEMPLATE(X509_EXTENSIONS) =

package/third_party/boringssl/src/crypto/x509/x_name.c

@@ -99,7 +99,7 @@ static int i2d_name_canon(STACK_OF(STACK_OF_X509_NAME_ENTRY) * intname,
 
 ASN1_SEQUENCE(X509_NAME_ENTRY) = {
         ASN1_SIMPLE(X509_NAME_ENTRY, object, ASN1_OBJECT),
-        ASN1_SIMPLE(X509_NAME_ENTRY, value, ASN1_PRINTABLE)
+        ASN1_SIMPLE(X509_NAME_ENTRY, value, ASN1_PRINTABLE),
 } ASN1_SEQUENCE_END(X509_NAME_ENTRY)
 
 IMPLEMENT_ASN1_FUNCTIONS(X509_NAME_ENTRY)

package/third_party/boringssl/src/crypto/x509/x_pubkey.c

@@ -83,7 +83,7 @@ static int pubkey_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it,
 
 ASN1_SEQUENCE_cb(X509_PUBKEY, pubkey_cb) = {
         ASN1_SIMPLE(X509_PUBKEY, algor, X509_ALGOR),
-        ASN1_SIMPLE(X509_PUBKEY, public_key, ASN1_BIT_STRING)
+        ASN1_SIMPLE(X509_PUBKEY, public_key, ASN1_BIT_STRING),
 } ASN1_SEQUENCE_END_cb(X509_PUBKEY, X509_PUBKEY)
 
 IMPLEMENT_ASN1_FUNCTIONS(X509_PUBKEY)

package/third_party/boringssl/src/crypto/x509/x_req.c

@@ -98,7 +98,7 @@ ASN1_SEQUENCE_enc(X509_REQ_INFO, enc, rinf_cb) = {
         ASN1_SIMPLE(X509_REQ_INFO, subject, X509_NAME),
         ASN1_SIMPLE(X509_REQ_INFO, pubkey, X509_PUBKEY),
         /* This isn't really OPTIONAL but it gets around invalid encodings. */
-        ASN1_IMP_SET_OF_OPT(X509_REQ_INFO, attributes, X509_ATTRIBUTE, 0)
+        ASN1_IMP_SET_OF_OPT(X509_REQ_INFO, attributes, X509_ATTRIBUTE, 0),
 } ASN1_SEQUENCE_END_enc(X509_REQ_INFO, X509_REQ_INFO)
 
 IMPLEMENT_ASN1_FUNCTIONS(X509_REQ_INFO)
@@ -106,7 +106,7 @@ IMPLEMENT_ASN1_FUNCTIONS(X509_REQ_INFO)
 ASN1_SEQUENCE_ref(X509_REQ, 0) = {
         ASN1_SIMPLE(X509_REQ, req_info, X509_REQ_INFO),
         ASN1_SIMPLE(X509_REQ, sig_alg, X509_ALGOR),
-        ASN1_SIMPLE(X509_REQ, signature, ASN1_BIT_STRING)
+        ASN1_SIMPLE(X509_REQ, signature, ASN1_BIT_STRING),
 } ASN1_SEQUENCE_END_ref(X509_REQ, X509_REQ)
 
 IMPLEMENT_ASN1_FUNCTIONS(X509_REQ)

package/third_party/boringssl/src/crypto/x509/x_sig.c

@@ -68,7 +68,7 @@ struct X509_sig_st {
 
 ASN1_SEQUENCE(X509_SIG) = {
         ASN1_SIMPLE(X509_SIG, algor, X509_ALGOR),
-        ASN1_SIMPLE(X509_SIG, digest, ASN1_OCTET_STRING)
+        ASN1_SIMPLE(X509_SIG, digest, ASN1_OCTET_STRING),
 } ASN1_SEQUENCE_END(X509_SIG)
 
 IMPLEMENT_ASN1_FUNCTIONS(X509_SIG)

package/third_party/boringssl/src/crypto/x509/x_spki.c

@@ -66,7 +66,7 @@
 
 ASN1_SEQUENCE(NETSCAPE_SPKAC) = {
         ASN1_SIMPLE(NETSCAPE_SPKAC, pubkey, X509_PUBKEY),
-        ASN1_SIMPLE(NETSCAPE_SPKAC, challenge, ASN1_IA5STRING)
+        ASN1_SIMPLE(NETSCAPE_SPKAC, challenge, ASN1_IA5STRING),
 } ASN1_SEQUENCE_END(NETSCAPE_SPKAC)
 
 IMPLEMENT_ASN1_FUNCTIONS(NETSCAPE_SPKAC)
@@ -74,7 +74,7 @@ IMPLEMENT_ASN1_FUNCTIONS(NETSCAPE_SPKAC)
 ASN1_SEQUENCE(NETSCAPE_SPKI) = {
         ASN1_SIMPLE(NETSCAPE_SPKI, spkac, NETSCAPE_SPKAC),
         ASN1_SIMPLE(NETSCAPE_SPKI, sig_algor, X509_ALGOR),
-        ASN1_SIMPLE(NETSCAPE_SPKI, signature, ASN1_BIT_STRING)
+        ASN1_SIMPLE(NETSCAPE_SPKI, signature, ASN1_BIT_STRING),
 } ASN1_SEQUENCE_END(NETSCAPE_SPKI)
 
 IMPLEMENT_ASN1_FUNCTIONS(NETSCAPE_SPKI)

package/third_party/boringssl/src/crypto/x509/x_val.c

@@ -65,7 +65,7 @@
 
 ASN1_SEQUENCE(X509_VAL) = {
         ASN1_SIMPLE(X509_VAL, notBefore, ASN1_TIME),
-        ASN1_SIMPLE(X509_VAL, notAfter, ASN1_TIME)
+        ASN1_SIMPLE(X509_VAL, notAfter, ASN1_TIME),
 } ASN1_SEQUENCE_END(X509_VAL)
 
 IMPLEMENT_ASN1_FUNCTIONS(X509_VAL)

package/third_party/boringssl/src/crypto/x509/x_x509.c

@@ -83,7 +83,7 @@ ASN1_SEQUENCE_enc(X509_CINF, enc, 0) = {
         ASN1_SIMPLE(X509_CINF, key, X509_PUBKEY),
         ASN1_IMP_OPT(X509_CINF, issuerUID, ASN1_BIT_STRING, 1),
         ASN1_IMP_OPT(X509_CINF, subjectUID, ASN1_BIT_STRING, 2),
-        ASN1_EXP_SEQUENCE_OF_OPT(X509_CINF, extensions, X509_EXTENSION, 3)
+        ASN1_EXP_SEQUENCE_OF_OPT(X509_CINF, extensions, X509_EXTENSION, 3),
 } ASN1_SEQUENCE_END_enc(X509_CINF, X509_CINF)
 
 IMPLEMENT_ASN1_FUNCTIONS(X509_CINF)
@@ -167,7 +167,7 @@ static int x509_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it,
 ASN1_SEQUENCE_ref(X509, x509_cb) = {
         ASN1_SIMPLE(X509, cert_info, X509_CINF),
         ASN1_SIMPLE(X509, sig_alg, X509_ALGOR),
-        ASN1_SIMPLE(X509, signature, ASN1_BIT_STRING)
+        ASN1_SIMPLE(X509, signature, ASN1_BIT_STRING),
 } ASN1_SEQUENCE_END_ref(X509, X509)
 
 IMPLEMENT_ASN1_FUNCTIONS(X509)

package/third_party/boringssl/src/crypto/x509v3/v3_akey.c

@@ -82,7 +82,7 @@ const X509V3_EXT_METHOD v3_akey_id = {
     i2v_AUTHORITY_KEYID,
     v2i_AUTHORITY_KEYID,
     0, 0,
-    NULL
+    NULL,
 };
 
 static STACK_OF(CONF_VALUE) *i2v_AUTHORITY_KEYID(

package/third_party/boringssl/src/crypto/x509v3/v3_akeya.c

@@ -66,7 +66,7 @@
 ASN1_SEQUENCE(AUTHORITY_KEYID) = {
         ASN1_IMP_OPT(AUTHORITY_KEYID, keyid, ASN1_OCTET_STRING, 0),
         ASN1_IMP_SEQUENCE_OF_OPT(AUTHORITY_KEYID, issuer, GENERAL_NAME, 1),
-        ASN1_IMP_OPT(AUTHORITY_KEYID, serial, ASN1_INTEGER, 2)
+        ASN1_IMP_OPT(AUTHORITY_KEYID, serial, ASN1_INTEGER, 2),
 } ASN1_SEQUENCE_END(AUTHORITY_KEYID)
 
 IMPLEMENT_ASN1_FUNCTIONS(AUTHORITY_KEYID)

package/third_party/boringssl/src/crypto/x509v3/v3_bcons.c

@@ -79,12 +79,12 @@ const X509V3_EXT_METHOD v3_bcons = {
     i2v_BASIC_CONSTRAINTS,
     v2i_BASIC_CONSTRAINTS,
     NULL, NULL,
-    NULL
+    NULL,
 };
 
 ASN1_SEQUENCE(BASIC_CONSTRAINTS) = {
         ASN1_OPT(BASIC_CONSTRAINTS, ca, ASN1_FBOOLEAN),
-        ASN1_OPT(BASIC_CONSTRAINTS, pathlen, ASN1_INTEGER)
+        ASN1_OPT(BASIC_CONSTRAINTS, pathlen, ASN1_INTEGER),
 } ASN1_SEQUENCE_END(BASIC_CONSTRAINTS)
 
 IMPLEMENT_ASN1_FUNCTIONS(BASIC_CONSTRAINTS)

package/third_party/boringssl/src/crypto/x509v3/v3_cpols.c

@@ -93,7 +93,7 @@ const X509V3_EXT_METHOD v3_cpols = {
     0, 0,
     i2r_certpol,
     r2i_certpol,
-    NULL
+    NULL,
 };
 
 ASN1_ITEM_TEMPLATE(CERTIFICATEPOLICIES) =
@@ -104,7 +104,7 @@ IMPLEMENT_ASN1_FUNCTIONS(CERTIFICATEPOLICIES)
 
 ASN1_SEQUENCE(POLICYINFO) = {
         ASN1_SIMPLE(POLICYINFO, policyid, ASN1_OBJECT),
-        ASN1_SEQUENCE_OF_OPT(POLICYINFO, qualifiers, POLICYQUALINFO)
+        ASN1_SEQUENCE_OF_OPT(POLICYINFO, qualifiers, POLICYQUALINFO),
 } ASN1_SEQUENCE_END(POLICYINFO)
 
 IMPLEMENT_ASN1_FUNCTIONS(POLICYINFO)
@@ -113,26 +113,26 @@ ASN1_ADB_TEMPLATE(policydefault) = ASN1_SIMPLE(POLICYQUALINFO, d.other, ASN1_ANY
 
 ASN1_ADB(POLICYQUALINFO) = {
         ADB_ENTRY(NID_id_qt_cps, ASN1_SIMPLE(POLICYQUALINFO, d.cpsuri, ASN1_IA5STRING)),
-        ADB_ENTRY(NID_id_qt_unotice, ASN1_SIMPLE(POLICYQUALINFO, d.usernotice, USERNOTICE))
+        ADB_ENTRY(NID_id_qt_unotice, ASN1_SIMPLE(POLICYQUALINFO, d.usernotice, USERNOTICE)),
 } ASN1_ADB_END(POLICYQUALINFO, 0, pqualid, 0, &policydefault_tt, NULL);
 
 ASN1_SEQUENCE(POLICYQUALINFO) = {
         ASN1_SIMPLE(POLICYQUALINFO, pqualid, ASN1_OBJECT),
-        ASN1_ADB_OBJECT(POLICYQUALINFO)
+        ASN1_ADB_OBJECT(POLICYQUALINFO),
 } ASN1_SEQUENCE_END(POLICYQUALINFO)
 
 IMPLEMENT_ASN1_FUNCTIONS(POLICYQUALINFO)
 
 ASN1_SEQUENCE(USERNOTICE) = {
         ASN1_OPT(USERNOTICE, noticeref, NOTICEREF),
-        ASN1_OPT(USERNOTICE, exptext, DISPLAYTEXT)
+        ASN1_OPT(USERNOTICE, exptext, DISPLAYTEXT),
 } ASN1_SEQUENCE_END(USERNOTICE)
 
 IMPLEMENT_ASN1_FUNCTIONS(USERNOTICE)
 
 ASN1_SEQUENCE(NOTICEREF) = {
         ASN1_SIMPLE(NOTICEREF, organization, DISPLAYTEXT),
-        ASN1_SEQUENCE_OF(NOTICEREF, noticenos, ASN1_INTEGER)
+        ASN1_SEQUENCE_OF(NOTICEREF, noticenos, ASN1_INTEGER),
 } ASN1_SEQUENCE_END(NOTICEREF)
 
 IMPLEMENT_ASN1_FUNCTIONS(NOTICEREF)

package/third_party/boringssl/src/crypto/x509v3/v3_crld.c

@@ -82,7 +82,7 @@ const X509V3_EXT_METHOD v3_crld = {
     0,
     v2i_crld,
     i2r_crldp, 0,
-    NULL
+    NULL,
 };
 
 const X509V3_EXT_METHOD v3_freshest_crl = {
@@ -92,7 +92,7 @@ const X509V3_EXT_METHOD v3_freshest_crl = {
     0,
     v2i_crld,
     i2r_crldp, 0,
-    NULL
+    NULL,
 };
 
 static STACK_OF(GENERAL_NAME) *gnames_from_sectname(X509V3_CTX *ctx,
@@ -366,7 +366,7 @@ static int dpn_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it,
 
 ASN1_CHOICE_cb(DIST_POINT_NAME, dpn_cb) = {
         ASN1_IMP_SEQUENCE_OF(DIST_POINT_NAME, name.fullname, GENERAL_NAME, 0),
-        ASN1_IMP_SET_OF(DIST_POINT_NAME, name.relativename, X509_NAME_ENTRY, 1)
+        ASN1_IMP_SET_OF(DIST_POINT_NAME, name.relativename, X509_NAME_ENTRY, 1),
 } ASN1_CHOICE_END_cb(DIST_POINT_NAME, DIST_POINT_NAME, type)
 
 
@@ -375,7 +375,7 @@ IMPLEMENT_ASN1_FUNCTIONS(DIST_POINT_NAME)
 ASN1_SEQUENCE(DIST_POINT) = {
         ASN1_EXP_OPT(DIST_POINT, distpoint, DIST_POINT_NAME, 0),
         ASN1_IMP_OPT(DIST_POINT, reasons, ASN1_BIT_STRING, 1),
-        ASN1_IMP_SEQUENCE_OF_OPT(DIST_POINT, CRLissuer, GENERAL_NAME, 2)
+        ASN1_IMP_SEQUENCE_OF_OPT(DIST_POINT, CRLissuer, GENERAL_NAME, 2),
 } ASN1_SEQUENCE_END(DIST_POINT)
 
 IMPLEMENT_ASN1_FUNCTIONS(DIST_POINT)
@@ -392,7 +392,7 @@ ASN1_SEQUENCE(ISSUING_DIST_POINT) = {
         ASN1_IMP_OPT(ISSUING_DIST_POINT, onlyCA, ASN1_FBOOLEAN, 2),
         ASN1_IMP_OPT(ISSUING_DIST_POINT, onlysomereasons, ASN1_BIT_STRING, 3),
         ASN1_IMP_OPT(ISSUING_DIST_POINT, indirectCRL, ASN1_FBOOLEAN, 4),
-        ASN1_IMP_OPT(ISSUING_DIST_POINT, onlyattr, ASN1_FBOOLEAN, 5)
+        ASN1_IMP_OPT(ISSUING_DIST_POINT, onlyattr, ASN1_FBOOLEAN, 5),
 } ASN1_SEQUENCE_END(ISSUING_DIST_POINT)
 
 IMPLEMENT_ASN1_FUNCTIONS(ISSUING_DIST_POINT)
@@ -410,7 +410,7 @@ const X509V3_EXT_METHOD v3_idp = {
     0,
     v2i_idp,
     i2r_idp, 0,
-    NULL
+    NULL,
 };
 
 static void *v2i_idp(const X509V3_EXT_METHOD *method, X509V3_CTX *ctx,

package/third_party/boringssl/src/crypto/x509v3/v3_enum.c

@@ -101,5 +101,5 @@ const X509V3_EXT_METHOD v3_crl_reason = {
     i2s_ASN1_ENUMERATED_TABLE,
     0,
     0, 0, 0, 0,
-    (void *)crl_reasons
+    (void *)crl_reasons,
 };

package/third_party/boringssl/src/crypto/x509v3/v3_extku.c

@@ -78,7 +78,7 @@ const X509V3_EXT_METHOD v3_ext_ku = {
     i2v_EXTENDED_KEY_USAGE,
     v2i_EXTENDED_KEY_USAGE,
     0, 0,
-    NULL
+    NULL,
 };
 
 /* NB OCSP acceptable responses also is a SEQUENCE OF OBJECT */
@@ -90,7 +90,7 @@ const X509V3_EXT_METHOD v3_ocsp_accresp = {
     i2v_EXTENDED_KEY_USAGE,
     v2i_EXTENDED_KEY_USAGE,
     0, 0,
-    NULL
+    NULL,
 };
 
 ASN1_ITEM_TEMPLATE(EXTENDED_KEY_USAGE) =

package/third_party/boringssl/src/crypto/x509v3/v3_genn.c

@@ -66,7 +66,7 @@
 ASN1_SEQUENCE(OTHERNAME) = {
         ASN1_SIMPLE(OTHERNAME, type_id, ASN1_OBJECT),
         /* Maybe have a true ANY DEFINED BY later */
-        ASN1_EXP(OTHERNAME, value, ASN1_ANY, 0)
+        ASN1_EXP(OTHERNAME, value, ASN1_ANY, 0),
 } ASN1_SEQUENCE_END(OTHERNAME)
 
 IMPLEMENT_ASN1_FUNCTIONS(OTHERNAME)
@@ -74,7 +74,7 @@ IMPLEMENT_ASN1_FUNCTIONS(OTHERNAME)
 ASN1_SEQUENCE(EDIPARTYNAME) = {
         /* DirectoryString is a CHOICE type, so use explicit tagging. */
         ASN1_EXP_OPT(EDIPARTYNAME, nameAssigner, DIRECTORYSTRING, 0),
-        ASN1_EXP(EDIPARTYNAME, partyName, DIRECTORYSTRING, 1)
+        ASN1_EXP(EDIPARTYNAME, partyName, DIRECTORYSTRING, 1),
 } ASN1_SEQUENCE_END(EDIPARTYNAME)
 
 IMPLEMENT_ASN1_FUNCTIONS(EDIPARTYNAME)
@@ -90,7 +90,7 @@ ASN1_CHOICE(GENERAL_NAME) = {
         ASN1_IMP(GENERAL_NAME, d.ediPartyName, EDIPARTYNAME, GEN_EDIPARTY),
         ASN1_IMP(GENERAL_NAME, d.uniformResourceIdentifier, ASN1_IA5STRING, GEN_URI),
         ASN1_IMP(GENERAL_NAME, d.iPAddress, ASN1_OCTET_STRING, GEN_IPADD),
-        ASN1_IMP(GENERAL_NAME, d.registeredID, ASN1_OBJECT, GEN_RID)
+        ASN1_IMP(GENERAL_NAME, d.registeredID, ASN1_OBJECT, GEN_RID),
 } ASN1_CHOICE_END(GENERAL_NAME)
 
 IMPLEMENT_ASN1_FUNCTIONS(GENERAL_NAME)

package/third_party/boringssl/src/crypto/x509v3/v3_info.c

@@ -81,7 +81,7 @@ const X509V3_EXT_METHOD v3_info = { NID_info_access, X509V3_EXT_MULTILINE,
     i2v_AUTHORITY_INFO_ACCESS,
     v2i_AUTHORITY_INFO_ACCESS,
     0, 0,
-    NULL
+    NULL,
 };
 
 const X509V3_EXT_METHOD v3_sinfo = { NID_sinfo_access, X509V3_EXT_MULTILINE,
@@ -91,12 +91,12 @@ const X509V3_EXT_METHOD v3_sinfo = { NID_sinfo_access, X509V3_EXT_MULTILINE,
     i2v_AUTHORITY_INFO_ACCESS,
     v2i_AUTHORITY_INFO_ACCESS,
     0, 0,
-    NULL
+    NULL,
 };
 
 ASN1_SEQUENCE(ACCESS_DESCRIPTION) = {
         ASN1_SIMPLE(ACCESS_DESCRIPTION, method, ASN1_OBJECT),
-        ASN1_SIMPLE(ACCESS_DESCRIPTION, location, GENERAL_NAME)
+        ASN1_SIMPLE(ACCESS_DESCRIPTION, location, GENERAL_NAME),
 } ASN1_SEQUENCE_END(ACCESS_DESCRIPTION)
 
 IMPLEMENT_ASN1_FUNCTIONS(ACCESS_DESCRIPTION)

package/third_party/boringssl/src/crypto/x509v3/v3_int.c

@@ -77,7 +77,7 @@ const X509V3_EXT_METHOD v3_crl_num = {
     0, 0, 0, 0,
     i2s_ASN1_INTEGER_cb,
     0,
-    0, 0, 0, 0, NULL
+    0, 0, 0, 0, NULL,
 };
 
 const X509V3_EXT_METHOD v3_delta_crl = {
@@ -85,7 +85,7 @@ const X509V3_EXT_METHOD v3_delta_crl = {
     0, 0, 0, 0,
     i2s_ASN1_INTEGER_cb,
     0,
-    0, 0, 0, 0, NULL
+    0, 0, 0, 0, NULL,
 };
 
 const X509V3_EXT_METHOD v3_inhibit_anyp = {
@@ -93,5 +93,5 @@ const X509V3_EXT_METHOD v3_inhibit_anyp = {
     0, 0, 0, 0,
     i2s_ASN1_INTEGER_cb,
     s2i_asn1_int,
-    0, 0, 0, 0, NULL
+    0, 0, 0, 0, NULL,
 };

package/third_party/boringssl/src/crypto/x509v3/v3_ncons.c

@@ -93,13 +93,13 @@ const X509V3_EXT_METHOD v3_name_constraints = {
     0, 0,
     0, v2i_NAME_CONSTRAINTS,
     i2r_NAME_CONSTRAINTS, 0,
-    NULL
+    NULL,
 };
 
 ASN1_SEQUENCE(GENERAL_SUBTREE) = {
         ASN1_SIMPLE(GENERAL_SUBTREE, base, GENERAL_NAME),
         ASN1_IMP_OPT(GENERAL_SUBTREE, minimum, ASN1_INTEGER, 0),
-        ASN1_IMP_OPT(GENERAL_SUBTREE, maximum, ASN1_INTEGER, 1)
+        ASN1_IMP_OPT(GENERAL_SUBTREE, maximum, ASN1_INTEGER, 1),
 } ASN1_SEQUENCE_END(GENERAL_SUBTREE)
 
 ASN1_SEQUENCE(NAME_CONSTRAINTS) = {

package/third_party/boringssl/src/crypto/x509v3/v3_ocsp.c

@@ -31,7 +31,7 @@ const X509V3_EXT_METHOD v3_crl_invdate = {
     0, 0,
     0, 0,
     i2r_ocsp_acutoff, 0,
-    NULL
+    NULL,
 };
 
 const X509V3_EXT_METHOD v3_ocsp_nocheck = {
@@ -40,7 +40,7 @@ const X509V3_EXT_METHOD v3_ocsp_nocheck = {
     0, s2i_ocsp_nocheck,
     0, 0,
     i2r_ocsp_nocheck, 0,
-    NULL
+    NULL,
 };
 
 static int i2r_ocsp_acutoff(const X509V3_EXT_METHOD *method, void *cutoff,

package/third_party/boringssl/src/crypto/x509v3/v3_pcons.c

@@ -85,7 +85,7 @@ const X509V3_EXT_METHOD v3_policy_constraints = {
 
 ASN1_SEQUENCE(POLICY_CONSTRAINTS) = {
         ASN1_IMP_OPT(POLICY_CONSTRAINTS, requireExplicitPolicy, ASN1_INTEGER,0),
-        ASN1_IMP_OPT(POLICY_CONSTRAINTS, inhibitPolicyMapping, ASN1_INTEGER,1)
+        ASN1_IMP_OPT(POLICY_CONSTRAINTS, inhibitPolicyMapping, ASN1_INTEGER,1),
 } ASN1_SEQUENCE_END(POLICY_CONSTRAINTS)
 
 IMPLEMENT_ASN1_ALLOC_FUNCTIONS(POLICY_CONSTRAINTS)

package/third_party/boringssl/src/crypto/x509v3/v3_pmaps.c

@@ -77,12 +77,12 @@ const X509V3_EXT_METHOD v3_policy_mappings = {
     i2v_POLICY_MAPPINGS,
     v2i_POLICY_MAPPINGS,
     0, 0,
-    NULL
+    NULL,
 };
 
 ASN1_SEQUENCE(POLICY_MAPPING) = {
         ASN1_SIMPLE(POLICY_MAPPING, issuerDomainPolicy, ASN1_OBJECT),
-        ASN1_SIMPLE(POLICY_MAPPING, subjectDomainPolicy, ASN1_OBJECT)
+        ASN1_SIMPLE(POLICY_MAPPING, subjectDomainPolicy, ASN1_OBJECT),
 } ASN1_SEQUENCE_END(POLICY_MAPPING)
 
 ASN1_ITEM_TEMPLATE(POLICY_MAPPINGS) =

package/third_party/boringssl/src/crypto/x509v3/v3_skey.c

@@ -157,5 +157,5 @@ const X509V3_EXT_METHOD v3_skey_id = {
     i2s_ASN1_OCTET_STRING_cb,
     s2i_skey_id,
     0, 0, 0, 0,
-    NULL
+    NULL,
 };

package/third_party/boringssl/src/decrepit/blowfish/blowfish.c

@@ -61,6 +61,7 @@
 #include <assert.h>
 #include <string.h>
 
+#include "../../crypto/fipsmodule/cipher/internal.h"
 #include "../../crypto/internal.h"
 #include "../macros.h"
 

package/third_party/boringssl/src/decrepit/cast/cast.c

@@ -64,6 +64,7 @@ OPENSSL_MSVC_PRAGMA(warning(push, 3))
 OPENSSL_MSVC_PRAGMA(warning(pop))
 #endif
 
+#include "../../crypto/fipsmodule/cipher/internal.h"
 #include "../../crypto/internal.h"
 #include "internal.h"
 #include "../macros.h"

package/third_party/boringssl/src/decrepit/cfb/cfb.c

@@ -19,6 +19,7 @@
 #include <openssl/aes.h>
 #include <openssl/obj.h>
 
+#include "../../crypto/fipsmodule/cipher/internal.h"
 #include "../../crypto/internal.h"
 
 typedef struct {

package/third_party/boringssl/src/decrepit/xts/xts.c

@@ -53,7 +53,8 @@
 #include <openssl/aes.h>
 #include <openssl/cipher.h>
 
-#include "../crypto/fipsmodule/modes/internal.h"
+#include "../../crypto/fipsmodule/cipher/internal.h"
+#include "../../crypto/fipsmodule/modes/internal.h"
 
 
 typedef struct xts128_context {

package/third_party/boringssl/src/fuzz/CMakeLists.txt

@@ -30,3 +30,4 @@ fuzzer(dtls_client ssl)
 fuzzer(ssl_ctx_api ssl)
 fuzzer(session ssl)
 fuzzer(decode_client_hello_inner ssl)
+fuzzer(der_roundtrip)

package/third_party/boringssl/src/fuzz/der_roundtrip.cc

@@ -0,0 +1,57 @@
+/* Copyright (c) 2022, Google Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
+
+#include <stdlib.h>
+#include <string.h>
+
+#include <openssl/bytestring.h>
+#include <openssl/ecdsa.h>
+#include <openssl/mem.h>
+
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *buf, size_t len) {
+  CBS cbs, body;
+  unsigned tag;
+  CBS_init(&cbs, buf, len);
+  if (CBS_get_any_asn1(&cbs, &body, &tag)) {
+    // DER has a unique encoding, so any parsed input should round-trip
+    // correctly.
+    size_t consumed = len - CBS_len(&cbs);
+    bssl::ScopedCBB cbb;
+    CBB body_cbb;
+    if (!CBB_init(cbb.get(), consumed) ||
+        !CBB_add_asn1(cbb.get(), &body_cbb, tag) ||
+        !CBB_add_bytes(&body_cbb, CBS_data(&body), CBS_len(&body)) ||
+        !CBB_flush(cbb.get()) ||
+        CBB_len(cbb.get()) != consumed ||
+        memcmp(CBB_data(cbb.get()), buf, consumed) != 0) {
+      abort();
+    }
+  }
+
+  ECDSA_SIG *sig = ECDSA_SIG_from_bytes(buf, len);
+  if (sig != NULL) {
+    uint8_t *enc;
+    size_t enc_len;
+    if (!ECDSA_SIG_to_bytes(&enc, &enc_len, sig) ||
+        enc_len != len ||
+        memcmp(buf, enc, len) != 0) {
+      abort();
+    }
+    OPENSSL_free(enc);
+    ECDSA_SIG_free(sig);
+  }
+
+  return 0;
+}

package/third_party/boringssl/src/fuzz/der_roundtrip_corpus/082a991742f652549e4b207100ee521f474e0a99

@@ -0,0 +1 @@
+0
�

package/third_party/boringssl/src/fuzz/der_roundtrip_corpus/13e484c406efe97dc9d91f8b80a27b0e597c34da

@@ -0,0 +1 @@
+��3

package/third_party/boringssl/src/fuzz/der_roundtrip_corpus/163605136e22f5b5302fe60d1f17837bee6b6b2b

@@ -0,0 +1 @@
+0



package/third_party/boringssl/src/fuzz/der_roundtrip_corpus/1a96ec99b487b93052cd860c447e6d126dcc36d4

@@ -0,0 +1 @@
+���

package/third_party/boringssl/src/fuzz/der_roundtrip_corpus/1cc9ad96fcee279e8589b7071c7a0ccd111098f2

@@ -0,0 +1 @@
+0
]

package/third_party/boringssl/src/fuzz/der_roundtrip_corpus/229b8e1825512868e0e11a199ed71231dd41bb4f

@@ -0,0 +1 @@
+0;-:���

package/third_party/boringssl/src/fuzz/der_roundtrip_corpus/396d197005432accf99bf0f483286e459eb24063

@@ -0,0 +1 @@
+��܅���