Update BoringSSL to 0faffc7a30eeb195248ea43056f4848e2a9b1c6d (#134)

Package.swift

@@ -20,7 +20,7 @@
 // Sources/CCryptoBoringSSL directory. The source repository is at
 // https://boringssl.googlesource.com/boringssl.
 //
-// BoringSSL Commit: cab31f65f1ad6e6daca62e95b25dd6cd805fce0b
+// BoringSSL Commit: 0faffc7a30eeb195248ea43056f4848e2a9b1c6d
 
 import PackageDescription
 

Sources/CCryptoBoringSSL/CMakeLists.txt

@@ -29,7 +29,6 @@ add_library(CCryptoBoringSSL STATIC
   "crypto/asn1/a_time.c"
   "crypto/asn1/a_type.c"
   "crypto/asn1/a_utctm.c"
-  "crypto/asn1/a_utf8.c"
   "crypto/asn1/asn1_lib.c"
   "crypto/asn1/asn1_par.c"
   "crypto/asn1/asn_pack.c"
@@ -76,10 +75,12 @@ add_library(CCryptoBoringSSL STATIC
   "crypto/cipher_extra/tls_cbc.c"
   "crypto/conf/conf.c"
   "crypto/cpu_aarch64_apple.c"
+  "crypto/cpu_aarch64_freebsd.c"
   "crypto/cpu_aarch64_fuchsia.c"
   "crypto/cpu_aarch64_linux.c"
   "crypto/cpu_aarch64_win.c"
   "crypto/cpu_arm.c"
+  "crypto/cpu_arm_freebsd.c"
   "crypto/cpu_arm_linux.c"
   "crypto/cpu_intel.c"
   "crypto/cpu_ppc64le.c"

Sources/CCryptoBoringSSL/crypto/asn1/a_bitstr.c

@@ -115,6 +115,10 @@ int i2c_ASN1_BIT_STRING(const ASN1_BIT_STRING *a, unsigned char **pp) {
 
   uint8_t bits;
   int len = asn1_bit_string_length(a, &bits);
+  if (len > INT_MAX - 1) {
+    OPENSSL_PUT_ERROR(ASN1, ERR_R_OVERFLOW);
+    return 0;
+  }
   int ret = 1 + len;
   if (pp == NULL) {
     return ret;

Sources/CCryptoBoringSSL/crypto/asn1/a_strex.c

@@ -167,12 +167,17 @@ static int do_buf(const unsigned char *buf, int buflen, int encoding,
     }
     const int is_last = CBS_len(&cbs) == 0;
     if (flags & ASN1_STRFLGS_UTF8_CONVERT) {
-      unsigned char utfbuf[6];
-      int utflen;
-      utflen = UTF8_putc(utfbuf, sizeof(utfbuf), c);
-      for (int i = 0; i < utflen; i++) {
-        int len = do_esc_char(utfbuf[i], flags, quotes, out, is_first && i == 0,
-                              is_last && i == utflen - 1);
+      uint8_t utf8_buf[6];
+      CBB utf8_cbb;
+      CBB_init_fixed(&utf8_cbb, utf8_buf, sizeof(utf8_buf));
+      if (!cbb_add_utf8(&utf8_cbb, c)) {
+        OPENSSL_PUT_ERROR(ASN1, ERR_R_INTERNAL_ERROR);
+        return 1;
+      }
+      size_t utf8_len = CBB_len(&utf8_cbb);
+      for (size_t i = 0; i < utf8_len; i++) {
+        int len = do_esc_char(utf8_buf[i], flags, quotes, out,
+                              is_first && i == 0, is_last && i == utf8_len - 1);
         if (len < 0) {
           return -1;
         }

Sources/CCryptoBoringSSL/crypto/asn1/internal.h

@@ -96,7 +96,8 @@ OPENSSL_EXPORT int OPENSSL_timegm(const struct tm *tm, time_t *out);
 // |offset_day| days and |offset_sec| seconds. It returns zero on failure. |tm|
 // must be in the range of year 0000 to 9999 both before and after the update or
 // a failure will be returned.
-int OPENSSL_gmtime_adj(struct tm *tm, int offset_day, long offset_sec);
+OPENSSL_EXPORT int OPENSSL_gmtime_adj(struct tm *tm, int offset_day,
+                                      long offset_sec);
 
 // OPENSSL_gmtime_diff calculates the difference between |from| and |to|. It
 // returns one, and outputs the difference as a number of days and seconds in
@@ -156,8 +157,6 @@ OPENSSL_EXPORT int asn1_generalizedtime_to_tm(struct tm *tm,
 void asn1_item_combine_free(ASN1_VALUE **pval, const ASN1_ITEM *it,
                             int combine);
 
-int UTF8_putc(unsigned char *str, int len, uint32_t value);
-
 int ASN1_item_ex_new(ASN1_VALUE **pval, const ASN1_ITEM *it);
 void ASN1_item_ex_free(ASN1_VALUE **pval, const ASN1_ITEM *it);
 

Sources/CCryptoBoringSSL/crypto/asn1/posix_time.c

@@ -191,9 +191,10 @@ int OPENSSL_gmtime_adj(struct tm *tm, int off_day, long offset_sec) {
                            tm->tm_hour, tm->tm_min, tm->tm_sec, &posix_time)) {
     return 0;
   }
-  if (!utc_from_posix_time(posix_time + off_day * SECS_PER_DAY + offset_sec,
-                           &tm->tm_year, &tm->tm_mon, &tm->tm_mday,
-                           &tm->tm_hour, &tm->tm_min, &tm->tm_sec)) {
+  if (!utc_from_posix_time(
+          posix_time + (int64_t)off_day * SECS_PER_DAY + offset_sec,
+          &tm->tm_year, &tm->tm_mon, &tm->tm_mday, &tm->tm_hour, &tm->tm_min,
+          &tm->tm_sec)) {
     return 0;
   }
   tm->tm_year -= 1900;

Sources/CCryptoBoringSSL/crypto/bio/bio.c

@@ -192,7 +192,13 @@ int BIO_write_all(BIO *bio, const void *data, size_t len) {
 }
 
 int BIO_puts(BIO *bio, const char *in) {
-  return BIO_write(bio, in, strlen(in));
+  size_t len = strlen(in);
+  if (len > INT_MAX) {
+    // |BIO_write| and the return value both assume the string fits in |int|.
+    OPENSSL_PUT_ERROR(BIO, ERR_R_OVERFLOW);
+    return -1;
+  }
+  return BIO_write(bio, in, (int)len);
 }
 
 int BIO_flush(BIO *bio) {

Sources/CCryptoBoringSSL/crypto/bio/fd.c

@@ -158,7 +158,7 @@ static int fd_free(BIO *bio) {
 static int fd_read(BIO *b, char *out, int outl) {
   int ret = 0;
 
-  ret = BORINGSSL_READ(b->num, out, outl);
+  ret = (int)BORINGSSL_READ(b->num, out, outl);
   BIO_clear_retry_flags(b);
   if (ret <= 0) {
     if (bio_fd_should_retry(ret)) {
@@ -170,7 +170,7 @@ static int fd_read(BIO *b, char *out, int outl) {
 }
 
 static int fd_write(BIO *b, const char *in, int inl) {
-  int ret = BORINGSSL_WRITE(b->num, in, inl);
+  int ret = (int)BORINGSSL_WRITE(b->num, in, inl);
   BIO_clear_retry_flags(b);
   if (ret <= 0) {
     if (bio_fd_should_retry(ret)) {

Sources/CCryptoBoringSSL/crypto/bio/socket.c

@@ -101,7 +101,7 @@ static int sock_read(BIO *b, char *out, int outl) {
 #if defined(OPENSSL_WINDOWS)
   int ret = recv(b->num, out, outl, 0);
 #else
-  int ret = read(b->num, out, outl);
+  int ret = (int)read(b->num, out, outl);
 #endif
   BIO_clear_retry_flags(b);
   if (ret <= 0) {
@@ -113,13 +113,11 @@ static int sock_read(BIO *b, char *out, int outl) {
 }
 
 static int sock_write(BIO *b, const char *in, int inl) {
-  int ret;
-
   bio_clear_socket_error();
 #if defined(OPENSSL_WINDOWS)
-  ret = send(b->num, in, inl, 0);
+  int ret = send(b->num, in, inl, 0);
 #else
-  ret = write(b->num, in, inl);
+  int ret = (int)write(b->num, in, inl);
 #endif
   BIO_clear_retry_flags(b);
   if (ret <= 0) {

Sources/CCryptoBoringSSL/crypto/bytestring/asn1_compat.c

@@ -26,7 +26,8 @@
 
 
 int CBB_finish_i2d(CBB *cbb, uint8_t **outp) {
-  assert(cbb->base->can_resize);
+  assert(!cbb->is_child);
+  assert(cbb->u.base.can_resize);
 
   uint8_t *der;
   size_t der_len;