Upgrade chrome's OpenSSL to same version Android ships with.

openssl/crypto/rsa/rsa_eay.c

 /* crypto/rsa/rsa_eay.c */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
  * This package is an SSL implementation written
  * by Eric Young (eay@cryptsoft.com).
  * The implementation was written so as to conform with Netscapes SSL.
  * 
  * This library is free for commercial and non-commercial use as long as
  * the following conditions are aheared to.  The following conditions
@@ skipping 97 matching lines @@
  * Hudson (tjh@cryptsoft.com).
  *
  */
 
 #include <stdio.h>
 #include "cryptlib.h"
 #include <openssl/bn.h>
 #include <openssl/rsa.h>
 #include <openssl/rand.h>
 
-#if !defined(RSA_NULL) && !defined(OPENSSL_FIPS)
+#ifndef RSA_NULL
 
 static int RSA_eay_public_encrypt(int flen, const unsigned char *from,
                 unsigned char *to, RSA *rsa,int padding);
 static int RSA_eay_private_encrypt(int flen, const unsigned char *from,
                 unsigned char *to, RSA *rsa,int padding);
 static int RSA_eay_public_decrypt(int flen, const unsigned char *from,
                 unsigned char *to, RSA *rsa,int padding);
 static int RSA_eay_private_decrypt(int flen, const unsigned char *from,
                 unsigned char *to, RSA *rsa,int padding);
 static int RSA_eay_mod_exp(BIGNUM *r0, const BIGNUM *i, RSA *rsa, BN_CTX *ctx);
@@ skipping 120 matching lines @@
                 OPENSSL_cleanse(buf,num);
                 OPENSSL_free(buf);
                 }
         return(r);
         }
 
 static BN_BLINDING *rsa_get_blinding(RSA *rsa, int *local, BN_CTX *ctx)
 {
         BN_BLINDING *ret;
         int got_write_lock = 0;
+        CRYPTO_THREADID cur;
 
         CRYPTO_r_lock(CRYPTO_LOCK_RSA);
 
         if (rsa->blinding == NULL)
                 {
                 CRYPTO_r_unlock(CRYPTO_LOCK_RSA);
                 CRYPTO_w_lock(CRYPTO_LOCK_RSA);
                 got_write_lock = 1;
 
                 if (rsa->blinding == NULL)
                         rsa->blinding = RSA_setup_blinding(rsa, ctx);
                 }
 
         ret = rsa->blinding;
         if (ret == NULL)
                 goto err;
 
-        if (BN_BLINDING_get_thread_id(ret) == CRYPTO_thread_id())
+        CRYPTO_THREADID_current(&cur);
+        if (!CRYPTO_THREADID_cmp(&cur, BN_BLINDING_thread_id(ret)))
                 {
                 /* rsa->blinding is ours! */
 
                 *local = 1;
                 }
         else
                 {
                 /* resort to rsa->mt_blinding instead */
 
                 *local = 0; /* instructs rsa_blinding_convert(), rsa_blinding_invert()
@@ skipping 18 matching lines @@
                 }
 
  err:
         if (got_write_lock)
                 CRYPTO_w_unlock(CRYPTO_LOCK_RSA);
         else
                 CRYPTO_r_unlock(CRYPTO_LOCK_RSA);
         return ret;
 }
 
-static int rsa_blinding_convert(BN_BLINDING *b, int local, BIGNUM *f,
-        BIGNUM *r, BN_CTX *ctx)
-{
-        if (local)
+static int rsa_blinding_convert(BN_BLINDING *b, BIGNUM *f, BIGNUM *unblind,
+        BN_CTX *ctx)
+        {
+        if (unblind == NULL)
+                /* Local blinding: store the unblinding factor
+                 * in BN_BLINDING. */
                 return BN_BLINDING_convert_ex(f, NULL, b, ctx);
         else
                 {
-                int ret;
-                CRYPTO_r_lock(CRYPTO_LOCK_RSA_BLINDING);
-                ret = BN_BLINDING_convert_ex(f, r, b, ctx);
-                CRYPTO_r_unlock(CRYPTO_LOCK_RSA_BLINDING);
-                return ret;
-                }
-}
-
-static int rsa_blinding_invert(BN_BLINDING *b, int local, BIGNUM *f,
-        BIGNUM *r, BN_CTX *ctx)
-{
-        if (local)
-                return BN_BLINDING_invert_ex(f, NULL, b, ctx);
-        else
-                {
+                /* Shared blinding: store the unblinding factor
+                 * outside BN_BLINDING. */
                 int ret;
                 CRYPTO_w_lock(CRYPTO_LOCK_RSA_BLINDING);
-                ret = BN_BLINDING_invert_ex(f, r, b, ctx);
+                ret = BN_BLINDING_convert_ex(f, unblind, b, ctx);
                 CRYPTO_w_unlock(CRYPTO_LOCK_RSA_BLINDING);
                 return ret;
                 }
-}
+        }
+
+static int rsa_blinding_invert(BN_BLINDING *b, BIGNUM *f, BIGNUM *unblind,
+        BN_CTX *ctx)
+        {
+        /* For local blinding, unblind is set to NULL, and BN_BLINDING_invert_ex
+         * will use the unblinding factor stored in BN_BLINDING.
+         * If BN_BLINDING is shared between threads, unblind must be non-null:
+         * BN_BLINDING_invert_ex will then use the local unblinding factor,
+         * and will only read the modulus from BN_BLINDING.
+         * In both cases it's safe to access the blinding without a lock.
+         */
+        return BN_BLINDING_invert_ex(f, unblind, b, ctx);
+        }
 
 /* signing */
 static int RSA_eay_private_encrypt(int flen, const unsigned char *from,
              unsigned char *to, RSA *rsa, int padding)
         {
-        BIGNUM *f, *ret, *br, *res;
+        BIGNUM *f, *ret, *res;
         int i,j,k,num=0,r= -1;
         unsigned char *buf=NULL;
         BN_CTX *ctx=NULL;
         int local_blinding = 0;
+        /* Used only if the blinding structure is shared. A non-NULL unblind
+         * instructs rsa_blinding_convert() and rsa_blinding_invert() to store
+         * the unblinding factor outside the blinding structure. */
+        BIGNUM *unblind = NULL;
         BN_BLINDING *blinding = NULL;
 
         if ((ctx=BN_CTX_new()) == NULL) goto err;
         BN_CTX_start(ctx);
         f   = BN_CTX_get(ctx);
-        br  = BN_CTX_get(ctx);
         ret = BN_CTX_get(ctx);
         num = BN_num_bytes(rsa->n);
         buf = OPENSSL_malloc(num);
         if(!f || !ret || !buf)
                 {
                 RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT,ERR_R_MALLOC_FAILURE);
                 goto err;
                 }
 
         switch (padding)
@@ skipping 27 matching lines @@
                 {
                 blinding = rsa_get_blinding(rsa, &local_blinding, ctx);
                 if (blinding == NULL)
                         {
                         RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT, ERR_R_INTERNAL_ERROR);
                         goto err;
                         }
                 }
         
         if (blinding != NULL)
-                if (!rsa_blinding_convert(blinding, local_blinding, f, br, ctx))
+                {
+                if (!local_blinding && ((unblind = BN_CTX_get(ctx)) == NULL))
+                        {
+                        RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT,ERR_R_MALLOC_FAILURE);
                         goto err;
+                        }
+                if (!rsa_blinding_convert(blinding, f, unblind, ctx))
+                        goto err;
+                }
 
         if ( (rsa->flags & RSA_FLAG_EXT_PKEY) ||
                 ((rsa->p != NULL) &&
                 (rsa->q != NULL) &&
                 (rsa->dmp1 != NULL) &&
                 (rsa->dmq1 != NULL) &&
                 (rsa->iqmp != NULL)) )
                 { 
                 if (!rsa->meth->rsa_mod_exp(ret, f, rsa, ctx)) goto err;
                 }
@@ skipping 13 matching lines @@
 
                 if (rsa->flags & RSA_FLAG_CACHE_PUBLIC)
                         if(!BN_MONT_CTX_set_locked(&rsa->_method_mod_n, CRYPTO_LOCK_RSA, rsa->n, ctx))
                                 goto err;
 
                 if (!rsa->meth->bn_mod_exp(ret,f,d,rsa->n,ctx,
                                 rsa->_method_mod_n)) goto err;
                 }
 
         if (blinding)
-                if (!rsa_blinding_invert(blinding, local_blinding, ret, br, ctx))
+                if (!rsa_blinding_invert(blinding, ret, unblind, ctx))
                         goto err;
 
         if (padding == RSA_X931_PADDING)
                 {
                 BN_sub(f, rsa->n, ret);
                 if (BN_cmp(ret, f))
                         res = f;
                 else
                         res = ret;
                 }
@@ skipping 18 matching lines @@
                 {
                 OPENSSL_cleanse(buf,num);
                 OPENSSL_free(buf);
                 }
         return(r);
         }
 
 static int RSA_eay_private_decrypt(int flen, const unsigned char *from,
              unsigned char *to, RSA *rsa, int padding)
         {
-        BIGNUM *f, *ret, *br;
+        BIGNUM *f, *ret;
         int j,num=0,r= -1;
         unsigned char *p;
         unsigned char *buf=NULL;
         BN_CTX *ctx=NULL;
         int local_blinding = 0;
+        /* Used only if the blinding structure is shared. A non-NULL unblind
+         * instructs rsa_blinding_convert() and rsa_blinding_invert() to store
+         * the unblinding factor outside the blinding structure. */
+        BIGNUM *unblind = NULL;
         BN_BLINDING *blinding = NULL;
 
         if((ctx = BN_CTX_new()) == NULL) goto err;
         BN_CTX_start(ctx);
         f   = BN_CTX_get(ctx);
-        br  = BN_CTX_get(ctx);
         ret = BN_CTX_get(ctx);
         num = BN_num_bytes(rsa->n);
         buf = OPENSSL_malloc(num);
         if(!f || !ret || !buf)
                 {
                 RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT,ERR_R_MALLOC_FAILURE);
                 goto err;
                 }
 
         /* This check was for equality but PGP does evil things
@@ skipping 17 matching lines @@
                 {
                 blinding = rsa_get_blinding(rsa, &local_blinding, ctx);
                 if (blinding == NULL)
                         {
                         RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT, ERR_R_INTERNAL_ERROR);
                         goto err;
                         }
                 }
         
         if (blinding != NULL)
-                if (!rsa_blinding_convert(blinding, local_blinding, f, br, ctx))
+                {
+                if (!local_blinding && ((unblind = BN_CTX_get(ctx)) == NULL))
+                        {
+                        RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT,ERR_R_MALLOC_FAILURE);
                         goto err;
+                        }
+                if (!rsa_blinding_convert(blinding, f, unblind, ctx))
+                        goto err;
+                }
 
         /* do the decrypt */
         if ( (rsa->flags & RSA_FLAG_EXT_PKEY) ||
                 ((rsa->p != NULL) &&
                 (rsa->q != NULL) &&
                 (rsa->dmp1 != NULL) &&
                 (rsa->dmq1 != NULL) &&
                 (rsa->iqmp != NULL)) )
                 {
                 if (!rsa->meth->rsa_mod_exp(ret, f, rsa, ctx)) goto err;
@@ skipping 13 matching lines @@
 
                 if (rsa->flags & RSA_FLAG_CACHE_PUBLIC)
                         if (!BN_MONT_CTX_set_locked(&rsa->_method_mod_n, CRYPTO_LOCK_RSA, rsa->n, ctx))
                                 goto err;
                 if (!rsa->meth->bn_mod_exp(ret,f,d,rsa->n,ctx,
                                 rsa->_method_mod_n))
                   goto err;
                 }
 
         if (blinding)
-                if (!rsa_blinding_invert(blinding, local_blinding, ret, br, ctx))
+                if (!rsa_blinding_invert(blinding, ret, unblind, ctx))
                         goto err;
 
         p=buf;
         j=BN_bn2bin(ret,p); /* j is only used with no-padding mode */
 
         switch (padding)
                 {
         case RSA_PKCS1_PADDING:
                 r=RSA_padding_check_PKCS1_type_2(to,num,buf,j,num);
                 break;
@@ skipping 90 matching lines @@
                 }
 
         if (rsa->flags & RSA_FLAG_CACHE_PUBLIC)
                 if (!BN_MONT_CTX_set_locked(&rsa->_method_mod_n, CRYPTO_LOCK_RSA, rsa->n, ctx))
                         goto err;
 
         if (!rsa->meth->bn_mod_exp(ret,f,rsa->e,rsa->n,ctx,
                 rsa->_method_mod_n)) goto err;
 
         if ((padding == RSA_X931_PADDING) && ((ret->d[0] & 0xf) != 12))
-                BN_sub(ret, rsa->n, ret);
+                if (!BN_sub(ret, rsa->n, ret)) goto err;
 
         p=buf;
         i=BN_bn2bin(ret,p);
 
         switch (padding)
                 {
         case RSA_PKCS1_PADDING:
                 r=RSA_padding_check_PKCS1_type_1(to,num,buf,i,num);
                 break;
         case RSA_X931_PADDING:
@@ skipping 195 matching lines @@
         if (rsa->_method_mod_n != NULL)
                 BN_MONT_CTX_free(rsa->_method_mod_n);
         if (rsa->_method_mod_p != NULL)
                 BN_MONT_CTX_free(rsa->_method_mod_p);
         if (rsa->_method_mod_q != NULL)
                 BN_MONT_CTX_free(rsa->_method_mod_q);
         return(1);
         }
 
 #endif