@ttsc/win32-arm64 0.33.1 → 0.34.0

package/bin/go/src/compress/flate/token.go

@@ -4,20 +4,26 @@
 
 package flate
 
+import (
+	"math"
+)
+
 const (
-	// 2 bits:   type   0 = literal  1=EOF  2=Match   3=Unused
-	// 8 bits:   xlength = length - MIN_MATCH_LENGTH
-	// 22 bits   xoffset = offset - MIN_OFFSET_SIZE, or literal
-	lengthShift = 22
-	offsetMask  = 1<<lengthShift - 1
-	typeMask    = 3 << 30
-	literalType = 0 << 30
-	matchType   = 1 << 30
+	// Token is a compound value:
+	// bits 0-16  xoffset = offset - MIN_OFFSET_SIZE, or literal - 16 bits
+	// bits 16-22 offset code - 5 bits
+	// bits 22-30 xlength = length - MIN_MATCH_LENGTH - 8 bits
+	// bits 30-32 type, 0 = literal  1=EOF  2=Match   3=Unused - 2 bits
+	lengthShift         = 22
+	offsetMask          = 1<<lengthShift - 1
+	typeMask            = 3 << 30
+	matchType           = 1 << 30
+	matchOffsetOnlyMask = 0xffff
 )
 
 // The length code for length X (MIN_MATCH_LENGTH <= X <= MAX_MATCH_LENGTH)
 // is lengthCodes[length - MIN_MATCH_LENGTH]
-var lengthCodes = [...]uint32{
+var lengthCodes = [256]uint8{
 	0, 1, 2, 3, 4, 5, 6, 7, 8, 8,
 	9, 9, 10, 10, 11, 11, 12, 12, 12, 12,
 	13, 13, 13, 13, 14, 14, 14, 14, 15, 15,
@@ -46,7 +52,37 @@ var lengthCodes = [...]uint32{
 	27, 27, 27, 27, 27, 28,
 }
 
-var offsetCodes = [...]uint32{
+// lengthCodes1 is length codes, but starting at 1.
+var lengthCodes1 = [256]uint8{
+	1, 2, 3, 4, 5, 6, 7, 8, 9, 9,
+	10, 10, 11, 11, 12, 12, 13, 13, 13, 13,
+	14, 14, 14, 14, 15, 15, 15, 15, 16, 16,
+	16, 16, 17, 17, 17, 17, 17, 17, 17, 17,
+	18, 18, 18, 18, 18, 18, 18, 18, 19, 19,
+	19, 19, 19, 19, 19, 19, 20, 20, 20, 20,
+	20, 20, 20, 20, 21, 21, 21, 21, 21, 21,
+	21, 21, 21, 21, 21, 21, 21, 21, 21, 21,
+	22, 22, 22, 22, 22, 22, 22, 22, 22, 22,
+	22, 22, 22, 22, 22, 22, 23, 23, 23, 23,
+	23, 23, 23, 23, 23, 23, 23, 23, 23, 23,
+	23, 23, 24, 24, 24, 24, 24, 24, 24, 24,
+	24, 24, 24, 24, 24, 24, 24, 24, 25, 25,
+	25, 25, 25, 25, 25, 25, 25, 25, 25, 25,
+	25, 25, 25, 25, 25, 25, 25, 25, 25, 25,
+	25, 25, 25, 25, 25, 25, 25, 25, 25, 25,
+	26, 26, 26, 26, 26, 26, 26, 26, 26, 26,
+	26, 26, 26, 26, 26, 26, 26, 26, 26, 26,
+	26, 26, 26, 26, 26, 26, 26, 26, 26, 26,
+	26, 26, 27, 27, 27, 27, 27, 27, 27, 27,
+	27, 27, 27, 27, 27, 27, 27, 27, 27, 27,
+	27, 27, 27, 27, 27, 27, 27, 27, 27, 27,
+	27, 27, 27, 27, 28, 28, 28, 28, 28, 28,
+	28, 28, 28, 28, 28, 28, 28, 28, 28, 28,
+	28, 28, 28, 28, 28, 28, 28, 28, 28, 28,
+	28, 28, 28, 28, 28, 29,
+}
+
+var offsetCodes = [256]uint32{
 	0, 1, 2, 3, 4, 4, 5, 5, 6, 6, 6, 6, 7, 7, 7, 7,
 	8, 8, 8, 8, 8, 8, 8, 8, 9, 9, 9, 9, 9, 9, 9, 9,
 	10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10,
@@ -65,33 +101,209 @@ var offsetCodes = [...]uint32{
 	15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15,
 }
 
+// offsetCodes14 are offsetCodes, but with 14 added.
+var offsetCodes14 = [256]uint32{
+	14, 15, 16, 17, 18, 18, 19, 19, 20, 20, 20, 20, 21, 21, 21, 21,
+	22, 22, 22, 22, 22, 22, 22, 22, 23, 23, 23, 23, 23, 23, 23, 23,
+	24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24,
+	25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25, 25,
+	26, 26, 26, 26, 26, 26, 26, 26, 26, 26, 26, 26, 26, 26, 26, 26,
+	26, 26, 26, 26, 26, 26, 26, 26, 26, 26, 26, 26, 26, 26, 26, 26,
+	27, 27, 27, 27, 27, 27, 27, 27, 27, 27, 27, 27, 27, 27, 27, 27,
+	27, 27, 27, 27, 27, 27, 27, 27, 27, 27, 27, 27, 27, 27, 27, 27,
+	28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28,
+	28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28,
+	28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28,
+	28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28,
+	29, 29, 29, 29, 29, 29, 29, 29, 29, 29, 29, 29, 29, 29, 29, 29,
+	29, 29, 29, 29, 29, 29, 29, 29, 29, 29, 29, 29, 29, 29, 29, 29,
+	29, 29, 29, 29, 29, 29, 29, 29, 29, 29, 29, 29, 29, 29, 29, 29,
+	29, 29, 29, 29, 29, 29, 29, 29, 29, 29, 29, 29, 29, 29, 29, 29,
+}
+
+// A token is a token that will be written to output stream.
+// It is either a literal or a match with offset and length.
 type token uint32
 
-// Convert a literal into a literal token.
-func literalToken(literal uint32) token { return token(literalType + literal) }
+// tokens are compound values as described above.
+// Histograms are created as tokens are added.
+// A full block is allocated.
+type tokens struct {
+	extraHist [32]uint16  // codes 256->maxnumlit
+	offHist   [32]uint16  // offset codes
+	litHist   [256]uint16 // codes 0->255
+	nFilled   int
+	n         uint16 // Must be able to contain maxStoreBlockSize
+	tokens    [65536]token
+}
+
+// Reset resets the tokens and histograms.
+func (t *tokens) Reset() {
+	if t.n == 0 {
+		return
+	}
+	t.n = 0
+	t.nFilled = 0
+	clear(t.litHist[:])
+	clear(t.extraHist[:])
+	clear(t.offHist[:])
+}
+
+// indexTokens creates tokens from a slice of unindexed tokens.
+func indexTokens(in []token) tokens {
+	var t tokens
+	t.indexTokens(in)
+	return t
+}
+
+// indexTokens clears and sets t from a slice of unindexed tokens.
+func (t *tokens) indexTokens(in []token) {
+	t.Reset()
+	for _, tok := range in {
+		if tok < matchType {
+			t.AddLiteral(tok.literal())
+			continue
+		}
+		t.AddMatch(uint32(tok.length()), tok.offset()&matchOffsetOnlyMask)
+	}
+}
+
+// emitLiterals writes a literal chunk and returns the number of bytes written.
+func emitLiterals(dst *tokens, lit []byte) {
+	for _, v := range lit {
+		dst.tokens[dst.n] = token(v)
+		dst.litHist[v]++
+		dst.n++
+	}
+}
+
+// AddLiteral adds a single literal to the tokens.
+func (t *tokens) AddLiteral(lit byte) {
+	t.tokens[t.n] = token(lit)
+	t.litHist[lit]++
+	t.n++
+}
+
+// mFastLog2 returns a fast approximation of log2(val).
+// From https://stackoverflow.com/a/28730362.
+func mFastLog2(val float32) float32 {
+	ux := int32(math.Float32bits(val))
+	log2 := (float32)(((ux >> 23) & 255) - 128)
+	ux &= -0x7f800001
+	ux += 127 << 23
+	uval := math.Float32frombits(uint32(ux))
+	log2 += ((-0.34484843)*uval+2.02466578)*uval - 0.67487759
+	return log2
+}
 
-// Convert a < xlength, xoffset > pair into a match token.
-func matchToken(xlength uint32, xoffset uint32) token {
-	return token(matchType + xlength<<lengthShift + xoffset)
+// EstimatedBits returns an estimated minimum size for the
+// optimal compression of t.
+// Minimum 1 bit is assigned per symbol.
+// Maximum 15 bits are assigned per symbol.
+func (t *tokens) EstimatedBits() int {
+	shannon := float32(0)
+	bits := int(0)
+	nMatches := 0
+	total := int(t.n) + t.nFilled
+	if total > 0 {
+		invTotal := 1.0 / float32(total)
+		for _, v := range t.litHist[:] {
+			if v > 0 {
+				n := float32(v)
+				shannon += min(15, max(1, -mFastLog2(n*invTotal))) * n
+			}
+		}
+		// Just add 15 for EOB
+		shannon += 15
+		for i, v := range t.extraHist[1 : literalCount-256] {
+			if v > 0 {
+				n := float32(v)
+				shannon += min(15, max(1, -mFastLog2(n*invTotal))) * n
+				bits += int(lengthExtraBits[i&31]) * int(v)
+				nMatches += int(v)
+			}
+		}
+	}
+	if nMatches > 0 {
+		invTotal := 1.0 / float32(nMatches)
+		for i, v := range t.offHist[:offsetCodeCount] {
+			if v > 0 {
+				n := float32(v)
+				shannon += min(15, max(1, -mFastLog2(n*invTotal))) * n
+				bits += int(offsetExtraBits[i&31]) * int(v)
+			}
+		}
+	}
+	return int(shannon) + bits
 }
 
-// Returns the literal of a literal token.
-func (t token) literal() uint32 { return uint32(t - literalType) }
+// AddMatch adds a match to the tokens.
+// This function is very sensitive to inlining and right on the border.
+func (t *tokens) AddMatch(xlength uint32, xoffset uint32) {
+	oCode := offsetCode(xoffset)
+	xoffset |= oCode << 16
 
-// Returns the extra offset of a match token.
+	t.extraHist[lengthCodes1[uint8(xlength)]]++
+	t.offHist[oCode&31]++
+	t.tokens[t.n] = token(matchType | xlength<<lengthShift | xoffset)
+	t.n++
+}
+
+// AddMatchLong adds a match to the tokens, potentially longer than max match length.
+// Length should NOT have the base subtracted, only offset should.
+func (t *tokens) AddMatchLong(xlength int32, xoffset uint32) {
+	oc := offsetCode(xoffset)
+	xoffset |= oc << 16
+	for xlength > 0 {
+		xl := xlength
+		if xl > 258 {
+			// We need to have at least baseMatchLength left over for next loop.
+			if xl > 258+baseMatchLength {
+				xl = 258
+			} else {
+				xl = 258 - baseMatchLength
+			}
+		}
+		xlength -= xl
+		xl -= baseMatchLength
+		t.extraHist[lengthCodes1[uint8(xl)]]++
+		t.offHist[oc&31]++
+		t.tokens[t.n] = token(matchType | uint32(xl)<<lengthShift | xoffset)
+		t.n++
+	}
+}
+
+// AddEOB adds an end of block marker to the tokens.
+func (t *tokens) AddEOB() {
+	t.tokens[t.n] = token(endBlockMarker)
+	t.extraHist[0]++
+	t.n++
+}
+
+// Slice returns a slice of the tokens that references the tokens in t.
+func (t *tokens) Slice() []token {
+	return t.tokens[:t.n]
+}
+
+// typ returns the type of a token.
+func (t token) typ() uint32 { return uint32(t) & typeMask }
+
+// literal returns the literal value of t.
+func (t token) literal() uint8 { return uint8(t) }
+
+// offset returns the offset of a match token.
 func (t token) offset() uint32 { return uint32(t) & offsetMask }
 
-func (t token) length() uint32 { return uint32((t - matchType) >> lengthShift) }
+// length returns the length of a match token.
+func (t token) length() uint8 { return uint8(t >> lengthShift) }
 
-func lengthCode(len uint32) uint32 { return lengthCodes[len] }
+// lengthCode converts a match length to its code.
+func lengthCode(len uint8) uint8 { return lengthCodes[len] }
 
-// Returns the offset code corresponding to a specific offset.
+// offsetCode returns the offset code corresponding to a specific offset.
 func offsetCode(off uint32) uint32 {
 	if off < uint32(len(offsetCodes)) {
-		return offsetCodes[off]
-	}
-	if off>>7 < uint32(len(offsetCodes)) {
-		return offsetCodes[off>>7] + 14
+		return offsetCodes[uint8(off)]
 	}
-	return offsetCodes[off>>14] + 28
+	return offsetCodes14[uint8(off>>7)]
 }

package/bin/go/src/compress/gzip/gzip.go

@@ -46,6 +46,10 @@ type Writer struct {
 //
 // Callers that wish to set the fields in Writer.[Header] must do so before
 // the first call to Write, Flush, or Close.
+//
+// Note that the exact bytes written to w are not covered by the Go 1
+// compatibility promise. Callers, including tests, should not depend on the
+// exact written bytes.
 func NewWriter(w io.Writer) *Writer {
 	z, _ := NewWriterLevel(w, DefaultCompression)
 	return z
@@ -57,6 +61,10 @@ func NewWriter(w io.Writer) *Writer {
 // The compression level can be [DefaultCompression], [NoCompression], [HuffmanOnly]
 // or any integer value between [BestSpeed] and [BestCompression] inclusive.
 // The error returned will be nil if the level is valid.
+//
+// Note that the exact bytes written to w are not covered by the Go 1
+// compatibility promise. Callers, including tests, should not depend on the
+// exact written bytes.
 func NewWriterLevel(w io.Writer, level int) (*Writer, error) {
 	if level < HuffmanOnly || level > BestCompression {
 		return nil, fmt.Errorf("gzip: invalid compression level: %d", level)

package/bin/go/src/compress/zlib/writer.go

@@ -41,6 +41,10 @@ type Writer struct {
 //
 // It is the caller's responsibility to call Close on the Writer when done.
 // Writes may be buffered and not flushed until Close.
+//
+// Note that the exact bytes written to w are not covered by the Go 1
+// compatibility promise. Callers, including tests, should not depend on the
+// exact written bytes.
 func NewWriter(w io.Writer) *Writer {
 	z, _ := NewWriterLevelDict(w, DefaultCompression, nil)
 	return z
@@ -52,6 +56,10 @@ func NewWriter(w io.Writer) *Writer {
 // The compression level can be [DefaultCompression], [NoCompression], [HuffmanOnly]
 // or any integer value between [BestSpeed] and [BestCompression] inclusive.
 // The error returned will be nil if the level is valid.
+//
+// Note that the exact bytes written to w are not covered by the Go 1
+// compatibility promise. Callers, including tests, should not depend on the
+// exact written bytes.
 func NewWriterLevel(w io.Writer, level int) (*Writer, error) {
 	return NewWriterLevelDict(w, level, nil)
 }
@@ -61,6 +69,10 @@ func NewWriterLevel(w io.Writer, level int) (*Writer, error) {
 //
 // The dictionary may be nil. If not, its contents should not be modified until
 // the Writer is closed.
+//
+// Note that the exact bytes written to w are not covered by the Go 1
+// compatibility promise. Callers, including tests, should not depend on the
+// exact written bytes.
 func NewWriterLevelDict(w io.Writer, level int, dict []byte) (*Writer, error) {
 	if level < HuffmanOnly || level > BestCompression {
 		return nil, fmt.Errorf("zlib: invalid compression level: %d", level)

package/bin/go/src/context/context.go

@@ -24,11 +24,12 @@
 // child and its children until the parent is canceled. The go vet tool
 // checks that CancelFuncs are used on all control-flow paths.
 //
-// The [WithCancelCause], [WithDeadlineCause], and [WithTimeoutCause] functions
-// return a [CancelCauseFunc], which takes an error and records it as
-// the cancellation cause. Calling [Cause] on the canceled context
-// or any of its children retrieves the cause. If no cause is specified,
-// Cause(ctx) returns the same value as ctx.Err().
+// The [WithCancelCause] function returns a [CancelCauseFunc], which takes
+// an error and records it as the cancellation cause. [WithDeadlineCause]
+// and [WithTimeoutCause] take a cause to use when the deadline expires.
+// Calling [Cause] on the canceled context or any of its children retrieves
+// the cause. If no cause is specified, Cause(ctx) returns the same value
+// as ctx.Err().
 //
 // Programs that use Contexts should follow these rules to keep interfaces
 // consistent across packages and enable static analysis tools to check context

package/bin/go/src/crypto/cipher/gcm.go

@@ -23,10 +23,6 @@ const (
 
 // NewGCM returns the given 128-bit, block cipher wrapped in Galois Counter Mode
 // with the standard nonce length.
-//
-// In general, the GHASH operation performed by this implementation of GCM is not constant-time.
-// An exception is when the underlying [Block] was created by aes.NewCipher
-// on systems with hardware support for AES. See the [crypto/aes] package documentation for details.
 func NewGCM(cipher Block) (AEAD, error) {
 	if fips140only.Enforced() {
 		return nil, errors.New("crypto/cipher: use of GCM with arbitrary IVs is not allowed in FIPS 140-only mode, use NewGCMWithRandomNonce")

package/bin/go/src/crypto/crypto.go

@@ -60,6 +60,8 @@ func (h Hash) String() string {
 		return "BLAKE2b-384"
 	case BLAKE2b_512:
 		return "BLAKE2b-512"
+	case MLDSAMu:
+		return "ML-DSA μ message representative"
 	default:
 		return "unknown hash value " + strconv.Itoa(int(h))
 	}
@@ -85,6 +87,14 @@ const (
 	BLAKE2b_256                 // import golang.org/x/crypto/blake2b
 	BLAKE2b_384                 // import golang.org/x/crypto/blake2b
 	BLAKE2b_512                 // import golang.org/x/crypto/blake2b
+
+	// MLDSAMu is a sentinel value for a [pre-hashed μ message representative].
+	// It has no implementation, but is used as a [SignerOpts.HashFunc] return
+	// value for [crypto/mldsa.PrivateKey.Sign].
+	//
+	// [pre-hashed μ message representative]: https://www.rfc-editor.org/rfc/rfc9881.html#externalmu
+	MLDSAMu
+
 	maxHash
 )
 
@@ -108,6 +118,7 @@ var digestSizes = []uint8{
 	BLAKE2b_256: 32,
 	BLAKE2b_384: 48,
 	BLAKE2b_512: 64,
+	MLDSAMu:     64,
 }
 
 // Size returns the length, in bytes, of a digest resulting from the given hash
@@ -131,7 +142,7 @@ func (h Hash) New() hash.Hash {
 			return f()
 		}
 	}
-	panic("crypto: requested hash function #" + strconv.Itoa(int(h)) + " is unavailable")
+	panic("crypto: requested hash function unavailable: " + h.String())
 }
 
 // Available reports whether the given hash function is linked into the binary.
@@ -143,9 +154,12 @@ func (h Hash) Available() bool {
 // hash function. This is intended to be called from the init function in
 // packages that implement hash functions.
 func RegisterHash(h Hash, f func() hash.Hash) {
-	if h >= maxHash {
+	if h == 0 || h >= maxHash {
 		panic("crypto: RegisterHash of unknown hash function")
 	}
+	if h == MLDSAMu {
+		panic("crypto: cannot RegisterHash for MLDSAMu")
+	}
 	hashes[h] = f
 }
 
@@ -246,14 +260,23 @@ func SignMessage(signer Signer, rand io.Reader, msg []byte, opts SignerOpts) (si
 	if ms, ok := signer.(MessageSigner); ok {
 		return ms.SignMessage(rand, msg, opts)
 	}
-	if opts.HashFunc() != 0 {
-		h := opts.HashFunc().New()
+	if hash := opts.HashFunc(); hash != 0 {
+		if !hash.Available() {
+			return nil, hashUnavailableError(hash)
+		}
+		h := hash.New()
 		h.Write(msg)
 		msg = h.Sum(nil)
 	}
 	return signer.Sign(rand, msg, opts)
 }
 
+type hashUnavailableError Hash
+
+func (h hashUnavailableError) Error() string {
+	return "crypto: requested hash function unavailable: " + Hash(h).String()
+}
+
 // Decapsulator is an interface for an opaque private KEM key that can be used for
 // decapsulation operations. For example, an ML-KEM key kept in a hardware module.
 //

package/bin/go/src/crypto/des/const.go

@@ -22,7 +22,7 @@ var initialPermutation = [64]byte{
 	1, 9, 17, 25, 33, 41, 49, 57,
 }
 
-// Used to perform a final permutation of a 4-bit preoutput block. This is the
+// Used to perform a final permutation of a 64-bit preoutput block. This is the
 // inverse of initialPermutation
 var finalPermutation = [64]byte{
 	24, 56, 16, 48, 8, 40, 0, 32,

package/bin/go/src/crypto/ecdsa/ecdsa.go

@@ -321,6 +321,15 @@ func privateKeyBytes[P ecdsa.Point[P]](c *ecdsa.Curve[P], priv *PrivateKey) ([]b
 // function used to produce digest and priv.Curve must be one of
 // [elliptic.P224], [elliptic.P256], [elliptic.P384], or [elliptic.P521].
 func (priv *PrivateKey) Sign(random io.Reader, digest []byte, opts crypto.SignerOpts) ([]byte, error) {
+	if opts != nil {
+		h := opts.HashFunc()
+		if h == 0 {
+			return nil, errors.New("ecdsa: Sign must be called with a hash, not with crypto.Hash(0)")
+		}
+		if h.Size() != len(digest) {
+			return nil, errors.New("ecdsa: hash length does not match hash function")
+		}
+	}
 	if random == nil {
 		return signRFC6979(priv, digest, opts)
 	}
@@ -380,6 +389,10 @@ func generateFIPS[P ecdsa.Point[P]](curve elliptic.Curve, c *ecdsa.Curve[P], ran
 // is set. This setting will be removed in a future Go release. Instead, use
 // [testing/cryptotest.SetGlobalRandom].
 func SignASN1(r io.Reader, priv *PrivateKey, hash []byte) ([]byte, error) {
+	if len(hash) == 0 {
+		return nil, errors.New("ecdsa: hash cannot be empty")
+	}
+
 	if boring.Enabled && rand.IsDefaultReader(r) {
 		b, err := boringPrivateKey(priv)
 		if err != nil {
@@ -425,12 +438,9 @@ func signFIPS[P ecdsa.Point[P]](c *ecdsa.Curve[P], priv *PrivateKey, rand io.Rea
 
 func signRFC6979(priv *PrivateKey, hash []byte, opts crypto.SignerOpts) ([]byte, error) {
 	if opts == nil {
-		return nil, errors.New("ecdsa: Sign called with nil opts")
+		return nil, errors.New("ecdsa: Sign called with nil random and nil opts")
 	}
 	h := opts.HashFunc()
-	if h.Size() != len(hash) {
-		return nil, errors.New("ecdsa: hash length does not match hash function")
-	}
 	switch priv.Curve.Params() {
 	case elliptic.P224().Params():
 		return signFIPSDeterministic(ecdsa.P224(), h, priv, hash)
@@ -450,6 +460,9 @@ func signFIPSDeterministic[P ecdsa.Point[P]](c *ecdsa.Curve[P], hashFunc crypto.
 	if err != nil {
 		return nil, err
 	}
+	if !hashFunc.Available() {
+		return nil, errors.New("ecdsa: requested hash function unavailable: " + hashFunc.String())
+	}
 	h := fips140hash.UnwrapNew(hashFunc.New)
 	if fips140only.Enforced() && !fips140only.ApprovedHash(h()) {
 		return nil, errors.New("crypto/ecdsa: use of hash functions other than SHA-2 or SHA-3 is not allowed in FIPS 140-only mode")
@@ -494,6 +507,10 @@ func addASN1IntBytes(b *cryptobyte.Builder, bytes []byte) {
 // The inputs are not considered confidential, and may leak through timing side
 // channels, or if an attacker has control of part of the inputs.
 func VerifyASN1(pub *PublicKey, hash, sig []byte) bool {
+	if len(hash) == 0 {
+		return false
+	}
+
 	if boring.Enabled {
 		key, err := boringPublicKey(pub)
 		if err != nil {

package/bin/go/src/crypto/ed25519/ed25519.go

@@ -160,6 +160,19 @@ func GenerateKey(random io.Reader) (PublicKey, PrivateKey, error) {
 		}
 	}
 
+	if fips140only.Enforced() && !fips140only.ApprovedRandomReader(random) {
+		return nil, nil, errors.New("crypto/ed25519: only crypto/rand.Reader is allowed in FIPS 140-only mode")
+	}
+
+	if rand.IsDefaultReader(random) {
+		privateKey, err := ed25519.GenerateKey()
+		if err != nil {
+			return nil, nil, err
+		}
+		publicKey := PublicKey(privateKey.PublicKey())
+		return publicKey, PrivateKey(privateKey.Bytes()), nil
+	}
+
 	seed := make([]byte, SeedSize)
 	if _, err := io.ReadFull(random, seed); err != nil {
 		return nil, nil, err

package/bin/go/src/crypto/internal/boring/aes.go

@@ -48,6 +48,7 @@ import (
 	"crypto/cipher"
 	"errors"
 	"runtime"
+	"slices"
 	"strconv"
 	"unsafe"
 )
@@ -323,9 +324,7 @@ func (g *aesGCM) Seal(dst, nonce, plaintext, additionalData []byte) []byte {
 
 	// Make room in dst to append plaintext+overhead.
 	n := len(dst)
-	for cap(dst) < n+len(plaintext)+gcmTagSize {
-		dst = append(dst[:cap(dst)], 0)
-	}
+	dst = slices.Grow(dst, len(plaintext)+gcmTagSize)
 	dst = dst[:n+len(plaintext)+gcmTagSize]
 
 	// Check delayed until now to make sure len(dst) is accurate.

package/bin/go/src/crypto/internal/cryptotest/aead.go

@@ -53,6 +53,59 @@ func TestAEAD(t *testing.T, mAEAD MakeAEAD) {
 		}
 	})
 
+	t.Run("OutOfBounds", func(t *testing.T) {
+		// v1.26.0 and earlier have a harmless ciphertext overread/write in
+		// short-tag (not FIPS 140 Approved) AES-GCM.
+		MustMinimumFIPS140ModuleVersion(t, "v1.28.0")
+		// boundaryLengths covers every offset within an AES block, as well as the tail
+		// of a multi-block message, since that's where implementations handle partial
+		// blocks, and are most likely to access memory past the end of a buffer.
+		var boundaryLengths = []int{
+			0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15,
+			16, 17, 18, 127, 128, 129, 130, 131, 156, 8193,
+		}
+		for _, ptLen := range boundaryLengths {
+			t.Run(fmt.Sprintf("Plaintext-Length=%d", ptLen), func(t *testing.T) {
+				rng := newRandReader(t)
+
+				nonce := make([]byte, aead.NonceSize())
+				rng.Read(nonce)
+
+				plaintext, addData := make([]byte, ptLen), make([]byte, 16)
+				rng.Read(plaintext)
+				rng.Read(addData)
+
+				// Run a seal/open cycle with every buffer placed against an
+				// inaccessible page, so that any access past the end of a
+				// buffer (Boundary=End) or before its start (Boundary=Start)
+				// faults, rather than silently landing in adjacent memory.
+				for _, boundary := range []string{"Start", "End"} {
+					t.Run("Boundary="+boundary, func(t *testing.T) {
+						guarded := func(b []byte) []byte {
+							start, end := BoundarySlices(t, len(b))
+							if boundary == "Start" {
+								copy(start, b)
+								return start
+							}
+							copy(end, b)
+							return end
+						}
+
+						src, ad := guarded(plaintext), guarded(addData)
+						dst := guarded(make([]byte, ptLen+aead.Overhead()))
+
+						ciphertext := sealMsg(t, aead, dst[:0], nonce, src, ad)
+
+						after := openWithoutError(t, aead, guarded(plaintext)[:0], nonce, ciphertext, ad)
+						if !bytes.Equal(after, plaintext) {
+							t.Errorf("plaintext is different after a seal/open cycle; got %s, want %s", truncateHex(after), truncateHex(plaintext))
+						}
+					})
+				}
+			})
+		}
+	})
+
 	t.Run("InputNotModified", func(t *testing.T) {
 
 		// Test all combinations of plaintext and additional data lengths.

package/bin/go/src/crypto/internal/cryptotest/boundary.go

@@ -0,0 +1,34 @@
+// Copyright 2026 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build linux || darwin
+
+package cryptotest
+
+import (
+	"syscall"
+	"testing"
+)
+
+// BoundarySlices allocates a pair of slices of the given size one at the start
+// of a page, another at the end. Any access beyond or before the slice
+// boundaries should cause a fault.
+func BoundarySlices(t *testing.T, size int) (start, end []byte) {
+	pageSize := syscall.Getpagesize()
+	needPages := 2 + (2*size+pageSize-1)/pageSize
+	b, err := syscall.Mmap(0, 0, needPages*pageSize, syscall.PROT_READ|syscall.PROT_WRITE,
+		syscall.MAP_ANON|syscall.MAP_PRIVATE)
+	if err != nil {
+		t.Fatalf("mmap failed: %v", err)
+	}
+	t.Cleanup(func() { syscall.Munmap(b) })
+	if err := syscall.Mprotect(b[:pageSize], syscall.PROT_NONE); err != nil {
+		t.Fatalf("mprotect low failed: %v", err)
+	}
+	if err := syscall.Mprotect(b[len(b)-pageSize:], syscall.PROT_NONE); err != nil {
+		t.Fatalf("mprotect high failed: %v", err)
+	}
+	return b[pageSize : pageSize+size : pageSize+size],
+		b[len(b)-pageSize-size : len(b)-pageSize : len(b)-pageSize]
+}