BN_parse_asn1_unsigned: 21| 1.50k|int BN_parse_asn1_unsigned(CBS *cbs, BIGNUM *ret) { 22| 1.50k| CBS child; 23| 1.50k| int is_negative; 24| 1.50k| if (!CBS_get_asn1(cbs, &child, CBS_ASN1_INTEGER) || ------------------ | | 215| 1.50k|#define CBS_ASN1_INTEGER 0x2u ------------------ | Branch (24:7): [True: 22, False: 1.48k] ------------------ 25| 1.50k| !CBS_is_valid_asn1_integer(&child, &is_negative)) { ------------------ | Branch (25:7): [True: 14, False: 1.47k] ------------------ 26| 36| OPENSSL_PUT_ERROR(BN, BN_R_BAD_ENCODING); ------------------ | | 441| 36| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 27| 36| return 0; 28| 36| } 29| | 30| 1.47k| if (is_negative) { ------------------ | Branch (30:7): [True: 11, False: 1.46k] ------------------ 31| 11| OPENSSL_PUT_ERROR(BN, BN_R_NEGATIVE_NUMBER); ------------------ | | 441| 11| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 32| 11| return 0; 33| 11| } 34| | 35| 1.46k| return BN_bin2bn(CBS_data(&child), CBS_len(&child), ret) != NULL; 36| 1.47k|} BN_marshal_asn1: 38| 360|int BN_marshal_asn1(CBB *cbb, const BIGNUM *bn) { 39| | // Negative numbers are unsupported. 40| 360| if (BN_is_negative(bn)) { ------------------ | Branch (40:7): [True: 0, False: 360] ------------------ 41| 0| OPENSSL_PUT_ERROR(BN, BN_R_NEGATIVE_NUMBER); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 42| 0| return 0; 43| 0| } 44| | 45| 360| CBB child; 46| 360| if (!CBB_add_asn1(cbb, &child, CBS_ASN1_INTEGER) || ------------------ | | 215| 360|#define CBS_ASN1_INTEGER 0x2u ------------------ | Branch (46:7): [True: 0, False: 360] ------------------ 47| | // The number must be padded with a leading zero if the high bit would 48| | // otherwise be set or if |bn| is zero. 49| 360| (BN_num_bits(bn) % 8 == 0 && !CBB_add_u8(&child, 0x00)) || ------------------ | Branch (49:8): [True: 184, False: 176] | Branch (49:36): [True: 0, False: 184] ------------------ 50| 360| !BN_bn2cbb_padded(&child, BN_num_bytes(bn), bn) || ------------------ | Branch (50:7): [True: 0, False: 360] ------------------ 51| 360| !CBB_flush(cbb)) { ------------------ | Branch (51:7): [True: 0, False: 360] ------------------ 52| 0| OPENSSL_PUT_ERROR(BN, BN_R_ENCODE_ERROR); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 53| 0| return 0; 54| 0| } 55| | 56| 360| return 1; 57| 360|} BN_bn2cbb_padded: 72| 360|int BN_bn2cbb_padded(CBB *out, size_t len, const BIGNUM *in) { 73| 360| uint8_t *ptr; 74| 360| return CBB_add_space(out, &ptr, len) && BN_bn2bin_padded(ptr, len, in); ------------------ | Branch (74:10): [True: 360, False: 0] | Branch (74:43): [True: 360, False: 0] ------------------ 75| 360|} CBB_zero: 27| 4.97k|void CBB_zero(CBB *cbb) { 28| 4.97k| OPENSSL_memset(cbb, 0, sizeof(CBB)); 29| 4.97k|} CBB_init: 41| 808|int CBB_init(CBB *cbb, size_t initial_capacity) { 42| 808| CBB_zero(cbb); 43| | 44| 808| uint8_t *buf = OPENSSL_malloc(initial_capacity); 45| 808| if (initial_capacity > 0 && buf == NULL) { ------------------ | Branch (45:7): [True: 0, False: 808] | Branch (45:31): [True: 0, False: 0] ------------------ 46| 0| return 0; 47| 0| } 48| | 49| 808| cbb_init(cbb, buf, initial_capacity, /*can_resize=*/1); 50| 808| return 1; 51| 808|} CBB_cleanup: 59| 1.61k|void CBB_cleanup(CBB *cbb) { 60| | // Child |CBB|s are non-owning. They are implicitly discarded and should not 61| | // be used with |CBB_cleanup| or |ScopedCBB|. 62| 1.61k| assert(!cbb->is_child); 63| 1.61k| if (cbb->is_child) { ------------------ | Branch (63:7): [True: 0, False: 1.61k] ------------------ 64| 0| return; 65| 0| } 66| | 67| 1.61k| if (cbb->u.base.can_resize) { ------------------ | Branch (67:7): [True: 1.61k, False: 0] ------------------ 68| 1.61k| OPENSSL_free(cbb->u.base.buf); 69| 1.61k| } 70| 1.61k|} CBB_finish: 125| 808|int CBB_finish(CBB *cbb, uint8_t **out_data, size_t *out_len) { 126| 808| if (cbb->is_child) { ------------------ | Branch (126:7): [True: 0, False: 808] ------------------ 127| 0| OPENSSL_PUT_ERROR(CRYPTO, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 128| 0| return 0; 129| 0| } 130| | 131| 808| if (!CBB_flush(cbb)) { ------------------ | Branch (131:7): [True: 0, False: 808] ------------------ 132| 0| return 0; 133| 0| } 134| | 135| 808| if (cbb->u.base.can_resize && (out_data == NULL || out_len == NULL)) { ------------------ | Branch (135:7): [True: 808, False: 0] | Branch (135:34): [True: 0, False: 808] | Branch (135:54): [True: 0, False: 808] ------------------ 136| | // |out_data| and |out_len| can only be NULL if the CBB is fixed. 137| 0| return 0; 138| 0| } 139| | 140| 808| if (out_data != NULL) { ------------------ | Branch (140:7): [True: 808, False: 0] ------------------ 141| 808| *out_data = cbb->u.base.buf; 142| 808| } 143| 808| if (out_len != NULL) { ------------------ | Branch (143:7): [True: 808, False: 0] ------------------ 144| 808| *out_len = cbb->u.base.len; 145| 808| } 146| 808| cbb->u.base.buf = NULL; 147| 808| CBB_cleanup(cbb); 148| 808| return 1; 149| 808|} CBB_flush: 161| 18.2k|int CBB_flush(CBB *cbb) { 162| | // If |base| has hit an error, the buffer is in an undefined state, so 163| | // fail all following calls. In particular, |cbb->child| may point to invalid 164| | // memory. 165| 18.2k| struct cbb_buffer_st *base = cbb_get_base(cbb); 166| 18.2k| if (base == NULL || base->error) { ------------------ | Branch (166:7): [True: 0, False: 18.2k] | Branch (166:23): [True: 0, False: 18.2k] ------------------ 167| 0| return 0; 168| 0| } 169| | 170| 18.2k| if (cbb->child == NULL) { ------------------ | Branch (170:7): [True: 14.0k, False: 4.16k] ------------------ 171| | // Nothing to flush. 172| 14.0k| return 1; 173| 14.0k| } 174| | 175| 4.16k| assert(cbb->child->is_child); 176| 4.16k| struct cbb_child_st *child = &cbb->child->u.child; 177| 4.16k| assert(child->base == base); 178| 4.16k| size_t child_start = child->offset + child->pending_len_len; 179| | 180| 4.16k| if (!CBB_flush(cbb->child) || ------------------ | Branch (180:7): [True: 0, False: 4.16k] ------------------ 181| 4.16k| child_start < child->offset || ------------------ | Branch (181:7): [True: 0, False: 4.16k] ------------------ 182| 4.16k| base->len < child_start) { ------------------ | Branch (182:7): [True: 0, False: 4.16k] ------------------ 183| 0| goto err; 184| 0| } 185| | 186| 4.16k| size_t len = base->len - child_start; 187| | 188| 4.16k| if (child->pending_is_asn1) { ------------------ | Branch (188:7): [True: 4.16k, False: 0] ------------------ 189| | // For ASN.1 we assume that we'll only need a single byte for the length. 190| | // If that turned out to be incorrect, we have to move the contents along 191| | // in order to make space. 192| 4.16k| uint8_t len_len; 193| 4.16k| uint8_t initial_length_byte; 194| | 195| 4.16k| assert (child->pending_len_len == 1); 196| | 197| 4.16k| if (len > 0xfffffffe) { ------------------ | Branch (197:9): [True: 0, False: 4.16k] ------------------ 198| 0| OPENSSL_PUT_ERROR(CRYPTO, ERR_R_OVERFLOW); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 199| | // Too large. 200| 0| goto err; 201| 4.16k| } else if (len > 0xffffff) { ------------------ | Branch (201:16): [True: 0, False: 4.16k] ------------------ 202| 0| len_len = 5; 203| 0| initial_length_byte = 0x80 | 4; 204| 4.16k| } else if (len > 0xffff) { ------------------ | Branch (204:16): [True: 0, False: 4.16k] ------------------ 205| 0| len_len = 4; 206| 0| initial_length_byte = 0x80 | 3; 207| 4.16k| } else if (len > 0xff) { ------------------ | Branch (207:16): [True: 70, False: 4.09k] ------------------ 208| 70| len_len = 3; 209| 70| initial_length_byte = 0x80 | 2; 210| 4.09k| } else if (len > 0x7f) { ------------------ | Branch (210:16): [True: 77, False: 4.02k] ------------------ 211| 77| len_len = 2; 212| 77| initial_length_byte = 0x80 | 1; 213| 4.02k| } else { 214| 4.02k| len_len = 1; 215| 4.02k| initial_length_byte = (uint8_t)len; 216| 4.02k| len = 0; 217| 4.02k| } 218| | 219| 4.16k| if (len_len != 1) { ------------------ | Branch (219:9): [True: 147, False: 4.02k] ------------------ 220| | // We need to move the contents along in order to make space. 221| 147| size_t extra_bytes = len_len - 1; 222| 147| if (!cbb_buffer_add(base, NULL, extra_bytes)) { ------------------ | Branch (222:11): [True: 0, False: 147] ------------------ 223| 0| goto err; 224| 0| } 225| 147| OPENSSL_memmove(base->buf + child_start + extra_bytes, 226| 147| base->buf + child_start, len); 227| 147| } 228| 4.16k| base->buf[child->offset++] = initial_length_byte; 229| 4.16k| child->pending_len_len = len_len - 1; 230| 4.16k| } 231| | 232| 4.38k| for (size_t i = child->pending_len_len - 1; i < child->pending_len_len; i--) { ------------------ | Branch (232:47): [True: 217, False: 4.16k] ------------------ 233| 217| base->buf[child->offset + i] = (uint8_t)len; 234| 217| len >>= 8; 235| 217| } 236| 4.16k| if (len != 0) { ------------------ | Branch (236:7): [True: 0, False: 4.16k] ------------------ 237| 0| OPENSSL_PUT_ERROR(CRYPTO, ERR_R_OVERFLOW); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 238| 0| goto err; 239| 0| } 240| | 241| 4.16k| child->base = NULL; 242| 4.16k| cbb->child = NULL; 243| | 244| 4.16k| return 1; 245| | 246| 0|err: 247| 0| base->error = 1; 248| 0| return 0; 249| 4.16k|} CBB_add_asn1: 342| 4.16k|int CBB_add_asn1(CBB *cbb, CBB *out_contents, CBS_ASN1_TAG tag) { 343| 4.16k| if (!CBB_flush(cbb)) { ------------------ | Branch (343:7): [True: 0, False: 4.16k] ------------------ 344| 0| return 0; 345| 0| } 346| | 347| | // Split the tag into leading bits and tag number. 348| 4.16k| uint8_t tag_bits = (tag >> CBS_ASN1_TAG_SHIFT) & 0xe0; ------------------ | | 193| 4.16k|#define CBS_ASN1_TAG_SHIFT 24 ------------------ 349| 4.16k| CBS_ASN1_TAG tag_number = tag & CBS_ASN1_TAG_NUMBER_MASK; ------------------ | | 210| 4.16k|#define CBS_ASN1_TAG_NUMBER_MASK ((1u << (5 + CBS_ASN1_TAG_SHIFT)) - 1) | | ------------------ | | | | 193| 4.16k|#define CBS_ASN1_TAG_SHIFT 24 | | ------------------ ------------------ 350| 4.16k| if (tag_number >= 0x1f) { ------------------ | Branch (350:7): [True: 0, False: 4.16k] ------------------ 351| | // Set all the bits in the tag number to signal high tag number form. 352| 0| if (!CBB_add_u8(cbb, tag_bits | 0x1f) || ------------------ | Branch (352:9): [True: 0, False: 0] ------------------ 353| 0| !add_base128_integer(cbb, tag_number)) { ------------------ | Branch (353:9): [True: 0, False: 0] ------------------ 354| 0| return 0; 355| 0| } 356| 4.16k| } else if (!CBB_add_u8(cbb, tag_bits | tag_number)) { ------------------ | Branch (356:14): [True: 0, False: 4.16k] ------------------ 357| 0| return 0; 358| 0| } 359| | 360| | // Reserve one byte of length prefix. |CBB_flush| will finish it later. 361| 4.16k| return cbb_add_child(cbb, out_contents, /*len_len=*/1, /*is_asn1=*/1); 362| 4.16k|} CBB_add_bytes: 364| 1.32k|int CBB_add_bytes(CBB *cbb, const uint8_t *data, size_t len) { 365| 1.32k| uint8_t *out; 366| 1.32k| if (!CBB_add_space(cbb, &out, len)) { ------------------ | Branch (366:7): [True: 0, False: 1.32k] ------------------ 367| 0| return 0; 368| 0| } 369| 1.32k| OPENSSL_memcpy(out, data, len); 370| 1.32k| return 1; 371| 1.32k|} CBB_add_space: 382| 7.35k|int CBB_add_space(CBB *cbb, uint8_t **out_data, size_t len) { 383| 7.35k| if (!CBB_flush(cbb) || ------------------ | Branch (383:7): [True: 0, False: 7.35k] ------------------ 384| 7.35k| !cbb_buffer_add(cbb_get_base(cbb), out_data, len)) { ------------------ | Branch (384:7): [True: 0, False: 7.35k] ------------------ 385| 0| return 0; 386| 0| } 387| 7.35k| return 1; 388| 7.35k|} CBB_add_u8: 430| 5.15k|int CBB_add_u8(CBB *cbb, uint8_t value) { 431| 5.15k| return cbb_add_u(cbb, value, 1); 432| 5.15k|} cbb.c:cbb_init: 31| 808|static void cbb_init(CBB *cbb, uint8_t *buf, size_t cap, int can_resize) { 32| 808| cbb->is_child = 0; 33| 808| cbb->child = NULL; 34| 808| cbb->u.base.buf = buf; 35| 808| cbb->u.base.len = 0; 36| 808| cbb->u.base.cap = cap; 37| 808| cbb->u.base.can_resize = can_resize; 38| 808| cbb->u.base.error = 0; 39| 808|} cbb.c:cbb_get_base: 151| 29.7k|static struct cbb_buffer_st *cbb_get_base(CBB *cbb) { 152| 29.7k| if (cbb->is_child) { ------------------ | Branch (152:7): [True: 24.8k, False: 4.84k] ------------------ 153| 24.8k| return cbb->u.child.base; 154| 24.8k| } 155| 4.84k| return &cbb->u.base; 156| 29.7k|} cbb.c:cbb_buffer_add: 116| 11.6k| size_t len) { 117| 11.6k| if (!cbb_buffer_reserve(base, out, len)) { ------------------ | Branch (117:7): [True: 0, False: 11.6k] ------------------ 118| 0| return 0; 119| 0| } 120| | // This will not overflow or |cbb_buffer_reserve| would have failed. 121| 11.6k| base->len += len; 122| 11.6k| return 1; 123| 11.6k|} cbb.c:cbb_add_child: 272| 4.16k| int is_asn1) { 273| 4.16k| assert(cbb->child == NULL); 274| 4.16k| assert(!is_asn1 || len_len == 1); 275| 4.16k| struct cbb_buffer_st *base = cbb_get_base(cbb); 276| 4.16k| size_t offset = base->len; 277| | 278| | // Reserve space for the length prefix. 279| 4.16k| uint8_t *prefix_bytes; 280| 4.16k| if (!cbb_buffer_add(base, &prefix_bytes, len_len)) { ------------------ | Branch (280:7): [True: 0, False: 4.16k] ------------------ 281| 0| return 0; 282| 0| } 283| 4.16k| OPENSSL_memset(prefix_bytes, 0, len_len); 284| | 285| 4.16k| CBB_zero(out_child); 286| 4.16k| out_child->is_child = 1; 287| 4.16k| out_child->u.child.base = base; 288| 4.16k| out_child->u.child.offset = offset; 289| 4.16k| out_child->u.child.pending_len_len = len_len; 290| 4.16k| out_child->u.child.pending_is_asn1 = is_asn1; 291| 4.16k| cbb->child = out_child; 292| 4.16k| return 1; 293| 4.16k|} cbb.c:cbb_buffer_reserve: 73| 11.6k| size_t len) { 74| 11.6k| if (base == NULL) { ------------------ | Branch (74:7): [True: 0, False: 11.6k] ------------------ 75| 0| return 0; 76| 0| } 77| | 78| 11.6k| size_t newlen = base->len + len; 79| 11.6k| if (newlen < base->len) { ------------------ | Branch (79:7): [True: 0, False: 11.6k] ------------------ 80| | // Overflow 81| 0| OPENSSL_PUT_ERROR(CRYPTO, ERR_R_OVERFLOW); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 82| 0| goto err; 83| 0| } 84| | 85| 11.6k| if (newlen > base->cap) { ------------------ | Branch (85:7): [True: 5.46k, False: 6.21k] ------------------ 86| 5.46k| if (!base->can_resize) { ------------------ | Branch (86:9): [True: 0, False: 5.46k] ------------------ 87| 0| OPENSSL_PUT_ERROR(CRYPTO, ERR_R_OVERFLOW); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 88| 0| goto err; 89| 0| } 90| | 91| 5.46k| size_t newcap = base->cap * 2; 92| 5.46k| if (newcap < base->cap || newcap < newlen) { ------------------ | Branch (92:9): [True: 0, False: 5.46k] | Branch (92:31): [True: 1.36k, False: 4.09k] ------------------ 93| 1.36k| newcap = newlen; 94| 1.36k| } 95| 5.46k| uint8_t *newbuf = OPENSSL_realloc(base->buf, newcap); 96| 5.46k| if (newbuf == NULL) { ------------------ | Branch (96:9): [True: 0, False: 5.46k] ------------------ 97| 0| goto err; 98| 0| } 99| | 100| 5.46k| base->buf = newbuf; 101| 5.46k| base->cap = newcap; 102| 5.46k| } 103| | 104| 11.6k| if (out) { ------------------ | Branch (104:7): [True: 11.5k, False: 147] ------------------ 105| 11.5k| *out = base->buf + base->len; 106| 11.5k| } 107| | 108| 11.6k| return 1; 109| | 110| 0|err: 111| 0| base->error = 1; 112| 0| return 0; 113| 11.6k|} cbb.c:cbb_add_u: 410| 5.15k|static int cbb_add_u(CBB *cbb, uint64_t v, size_t len_len) { 411| 5.15k| uint8_t *buf; 412| 5.15k| if (!CBB_add_space(cbb, &buf, len_len)) { ------------------ | Branch (412:7): [True: 0, False: 5.15k] ------------------ 413| 0| return 0; 414| 0| } 415| | 416| 10.3k| for (size_t i = len_len - 1; i < len_len; i--) { ------------------ | Branch (416:32): [True: 5.15k, False: 5.15k] ------------------ 417| 5.15k| buf[i] = v; 418| 5.15k| v >>= 8; 419| 5.15k| } 420| | 421| | // |v| must fit in |len_len| bytes. 422| 5.15k| if (v != 0) { ------------------ | Branch (422:7): [True: 0, False: 5.15k] ------------------ 423| 0| cbb_get_base(cbb)->error = 1; 424| 0| return 0; 425| 0| } 426| | 427| 5.15k| return 1; 428| 5.15k|} CBS_init: 29| 12.5k|void CBS_init(CBS *cbs, const uint8_t *data, size_t len) { 30| 12.5k| cbs->data = data; 31| 12.5k| cbs->len = len; 32| 12.5k|} CBS_skip: 45| 10.1k|int CBS_skip(CBS *cbs, size_t len) { 46| 10.1k| const uint8_t *dummy; 47| 10.1k| return cbs_get(cbs, &dummy, len); 48| 10.1k|} CBS_data: 50| 6.40k|const uint8_t *CBS_data(const CBS *cbs) { 51| 6.40k| return cbs->data; 52| 6.40k|} CBS_len: 54| 34.1k|size_t CBS_len(const CBS *cbs) { 55| 34.1k| return cbs->len; 56| 34.1k|} CBS_get_u8: 108| 28.0k|int CBS_get_u8(CBS *cbs, uint8_t *out) { 109| 28.0k| const uint8_t *v; 110| 28.0k| if (!cbs_get(cbs, &v, 1)) { ------------------ | Branch (110:7): [True: 579, False: 27.4k] ------------------ 111| 579| return 0; 112| 579| } 113| 27.4k| *out = *v; 114| 27.4k| return 1; 115| 28.0k|} CBS_get_bytes: 181| 10.3k|int CBS_get_bytes(CBS *cbs, CBS *out, size_t len) { 182| 10.3k| const uint8_t *v; 183| 10.3k| if (!cbs_get(cbs, &v, len)) { ------------------ | Branch (183:7): [True: 113, False: 10.2k] ------------------ 184| 113| return 0; 185| 113| } 186| 10.2k| CBS_init(out, v, len); 187| 10.2k| return 1; 188| 10.3k|} CBS_get_any_asn1_element: 436| 10.7k| size_t *out_header_len) { 437| 10.7k| return cbs_get_any_asn1_element(cbs, out, out_tag, out_header_len, NULL, NULL, 438| 10.7k| /*ber_ok=*/0); 439| 10.7k|} CBS_get_asn1: 474| 10.7k|int CBS_get_asn1(CBS *cbs, CBS *out, CBS_ASN1_TAG tag_value) { 475| 10.7k| return cbs_get_asn1(cbs, out, tag_value, 1 /* skip header */); 476| 10.7k|} CBS_is_valid_asn1_integer: 671| 1.48k|int CBS_is_valid_asn1_integer(const CBS *cbs, int *out_is_negative) { 672| 1.48k| CBS copy = *cbs; 673| 1.48k| uint8_t first_byte, second_byte; 674| 1.48k| if (!CBS_get_u8(©, &first_byte)) { ------------------ | Branch (674:7): [True: 2, False: 1.48k] ------------------ 675| 2| return 0; // INTEGERs may not be empty. 676| 2| } 677| 1.48k| if (out_is_negative != NULL) { ------------------ | Branch (677:7): [True: 1.48k, False: 0] ------------------ 678| 1.48k| *out_is_negative = (first_byte & 0x80) != 0; 679| 1.48k| } 680| 1.48k| if (!CBS_get_u8(©, &second_byte)) { ------------------ | Branch (680:7): [True: 332, False: 1.15k] ------------------ 681| 332| return 1; // One byte INTEGERs are always minimal. 682| 332| } 683| 1.15k| if ((first_byte == 0x00 && (second_byte & 0x80) == 0) || ------------------ | Branch (683:8): [True: 546, False: 607] | Branch (683:30): [True: 3, False: 543] ------------------ 684| 1.15k| (first_byte == 0xff && (second_byte & 0x80) != 0)) { ------------------ | Branch (684:8): [True: 12, False: 1.13k] | Branch (684:30): [True: 9, False: 3] ------------------ 685| 12| return 0; // The value is minimal iff the first 9 bits are not all equal. 686| 12| } 687| 1.14k| return 1; 688| 1.15k|} cbs.c:cbs_get: 34| 49.2k|static int cbs_get(CBS *cbs, const uint8_t **p, size_t n) { 35| 49.2k| if (cbs->len < n) { ------------------ | Branch (35:7): [True: 696, False: 48.5k] ------------------ 36| 696| return 0; 37| 696| } 38| | 39| 48.5k| *p = cbs->data; 40| 48.5k| cbs->data += n; 41| 48.5k| cbs->len -= n; 42| 48.5k| return 1; 43| 49.2k|} cbs.c:cbs_get_u: 93| 713|static int cbs_get_u(CBS *cbs, uint64_t *out, size_t len) { 94| 713| uint64_t result = 0; 95| 713| const uint8_t *data; 96| | 97| 713| if (!cbs_get(cbs, &data, len)) { ------------------ | Branch (97:7): [True: 4, False: 709] ------------------ 98| 4| return 0; 99| 4| } 100| 1.81k| for (size_t i = 0; i < len; i++) { ------------------ | Branch (100:22): [True: 1.10k, False: 709] ------------------ 101| 1.10k| result <<= 8; 102| 1.10k| result |= data[i]; 103| 1.10k| } 104| 709| *out = result; 105| 709| return 1; 106| 713|} cbs.c:cbs_get_any_asn1_element: 322| 10.7k| int *out_indefinite, int ber_ok) { 323| 10.7k| CBS header = *cbs; 324| 10.7k| CBS throwaway; 325| | 326| 10.7k| if (out == NULL) { ------------------ | Branch (326:7): [True: 0, False: 10.7k] ------------------ 327| 0| out = &throwaway; 328| 0| } 329| 10.7k| if (ber_ok) { ------------------ | Branch (329:7): [True: 0, False: 10.7k] ------------------ 330| 0| *out_ber_found = 0; 331| 0| *out_indefinite = 0; 332| 10.7k| } else { 333| 10.7k| assert(out_ber_found == NULL); 334| 10.7k| assert(out_indefinite == NULL); 335| 10.7k| } 336| | 337| 10.7k| CBS_ASN1_TAG tag; 338| 10.7k| if (!parse_asn1_tag(&header, &tag)) { ------------------ | Branch (338:7): [True: 258, False: 10.4k] ------------------ 339| 258| return 0; 340| 258| } 341| 10.4k| if (out_tag != NULL) { ------------------ | Branch (341:7): [True: 10.4k, False: 0] ------------------ 342| 10.4k| *out_tag = tag; 343| 10.4k| } 344| | 345| 10.4k| uint8_t length_byte; 346| 10.4k| if (!CBS_get_u8(&header, &length_byte)) { ------------------ | Branch (346:7): [True: 91, False: 10.3k] ------------------ 347| 91| return 0; 348| 91| } 349| | 350| 10.3k| size_t header_len = CBS_len(cbs) - CBS_len(&header); 351| | 352| 10.3k| size_t len; 353| | // The format for the length encoding is specified in ITU-T X.690 section 354| | // 8.1.3. 355| 10.3k| if ((length_byte & 0x80) == 0) { ------------------ | Branch (355:7): [True: 9.65k, False: 733] ------------------ 356| | // Short form length. 357| 9.65k| len = ((size_t) length_byte) + header_len; 358| 9.65k| if (out_header_len != NULL) { ------------------ | Branch (358:9): [True: 9.65k, False: 0] ------------------ 359| 9.65k| *out_header_len = header_len; 360| 9.65k| } 361| 9.65k| } else { 362| | // The high bit indicate that this is the long form, while the next 7 bits 363| | // encode the number of subsequent octets used to encode the length (ITU-T 364| | // X.690 clause 8.1.3.5.b). 365| 733| const size_t num_bytes = length_byte & 0x7f; 366| 733| uint64_t len64; 367| | 368| 733| if (ber_ok && (tag & CBS_ASN1_CONSTRUCTED) != 0 && num_bytes == 0) { ------------------ | | 196| 0|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT) | | ------------------ | | | | 193| 0|#define CBS_ASN1_TAG_SHIFT 24 | | ------------------ ------------------ | Branch (368:9): [True: 0, False: 733] | Branch (368:19): [True: 0, False: 0] | Branch (368:56): [True: 0, False: 0] ------------------ 369| | // indefinite length 370| 0| if (out_header_len != NULL) { ------------------ | Branch (370:11): [True: 0, False: 0] ------------------ 371| 0| *out_header_len = header_len; 372| 0| } 373| 0| *out_ber_found = 1; 374| 0| *out_indefinite = 1; 375| 0| return CBS_get_bytes(cbs, out, header_len); 376| 0| } 377| | 378| | // ITU-T X.690 clause 8.1.3.5.c specifies that the value 0xff shall not be 379| | // used as the first byte of the length. If this parser encounters that 380| | // value, num_bytes will be parsed as 127, which will fail this check. 381| 733| if (num_bytes == 0 || num_bytes > 4) { ------------------ | Branch (381:9): [True: 1, False: 732] | Branch (381:27): [True: 19, False: 713] ------------------ 382| 20| return 0; 383| 20| } 384| 713| if (!cbs_get_u(&header, &len64, num_bytes)) { ------------------ | Branch (384:9): [True: 4, False: 709] ------------------ 385| 4| return 0; 386| 4| } 387| | // ITU-T X.690 section 10.1 (DER length forms) requires encoding the 388| | // length with the minimum number of octets. BER could, technically, have 389| | // 125 superfluous zero bytes. We do not attempt to handle that and still 390| | // require that the length fit in a |uint32_t| for BER. 391| 709| if (len64 < 128) { ------------------ | Branch (391:9): [True: 14, False: 695] ------------------ 392| | // Length should have used short-form encoding. 393| 14| if (ber_ok) { ------------------ | Branch (393:11): [True: 0, False: 14] ------------------ 394| 0| *out_ber_found = 1; 395| 14| } else { 396| 14| return 0; 397| 14| } 398| 14| } 399| 695| if ((len64 >> ((num_bytes - 1) * 8)) == 0) { ------------------ | Branch (399:9): [True: 3, False: 692] ------------------ 400| | // Length should have been at least one byte shorter. 401| 3| if (ber_ok) { ------------------ | Branch (401:11): [True: 0, False: 3] ------------------ 402| 0| *out_ber_found = 1; 403| 3| } else { 404| 3| return 0; 405| 3| } 406| 3| } 407| 692| len = len64; 408| 692| if (len + header_len + num_bytes < len) { ------------------ | Branch (408:9): [True: 0, False: 692] ------------------ 409| | // Overflow. 410| 0| return 0; 411| 0| } 412| 692| len += header_len + num_bytes; 413| 692| if (out_header_len != NULL) { ------------------ | Branch (413:9): [True: 692, False: 0] ------------------ 414| 692| *out_header_len = header_len + num_bytes; 415| 692| } 416| 692| } 417| | 418| 10.3k| return CBS_get_bytes(cbs, out, len); 419| 10.3k|} cbs.c:cbs_get_asn1: 452| 10.7k| int skip_header) { 453| 10.7k| size_t header_len; 454| 10.7k| CBS_ASN1_TAG tag; 455| 10.7k| CBS throwaway; 456| | 457| 10.7k| if (out == NULL) { ------------------ | Branch (457:7): [True: 0, False: 10.7k] ------------------ 458| 0| out = &throwaway; 459| 0| } 460| | 461| 10.7k| if (!CBS_get_any_asn1_element(cbs, out, &tag, &header_len) || ------------------ | Branch (461:7): [True: 503, False: 10.2k] ------------------ 462| 10.7k| tag != tag_value) { ------------------ | Branch (462:7): [True: 112, False: 10.1k] ------------------ 463| 615| return 0; 464| 615| } 465| | 466| 10.1k| if (skip_header && !CBS_skip(out, header_len)) { ------------------ | Branch (466:7): [True: 10.1k, False: 0] | Branch (466:22): [True: 0, False: 10.1k] ------------------ 467| 0| assert(0); 468| 0| return 0; 469| 0| } 470| | 471| 10.1k| return 1; 472| 10.1k|} cbs.c:parse_asn1_tag: 281| 10.7k|static int parse_asn1_tag(CBS *cbs, CBS_ASN1_TAG *out) { 282| 10.7k| uint8_t tag_byte; 283| 10.7k| if (!CBS_get_u8(cbs, &tag_byte)) { ------------------ | Branch (283:7): [True: 18, False: 10.7k] ------------------ 284| 18| return 0; 285| 18| } 286| | 287| | // ITU-T X.690 section 8.1.2.3 specifies the format for identifiers with a tag 288| | // number no greater than 30. 289| | // 290| | // If the number portion is 31 (0x1f, the largest value that fits in the 291| | // allotted bits), then the tag is more than one byte long and the 292| | // continuation bytes contain the tag number. 293| 10.7k| CBS_ASN1_TAG tag = ((CBS_ASN1_TAG)tag_byte & 0xe0) << CBS_ASN1_TAG_SHIFT; ------------------ | | 193| 10.7k|#define CBS_ASN1_TAG_SHIFT 24 ------------------ 294| 10.7k| CBS_ASN1_TAG tag_number = tag_byte & 0x1f; 295| 10.7k| if (tag_number == 0x1f) { ------------------ | Branch (295:7): [True: 376, False: 10.3k] ------------------ 296| 376| uint64_t v; 297| 376| if (!parse_base128_integer(cbs, &v) || ------------------ | Branch (297:9): [True: 136, False: 240] ------------------ 298| | // Check the tag number is within our supported bounds. 299| 376| v > CBS_ASN1_TAG_NUMBER_MASK || ------------------ | | 210| 616|#define CBS_ASN1_TAG_NUMBER_MASK ((1u << (5 + CBS_ASN1_TAG_SHIFT)) - 1) | | ------------------ | | | | 193| 240|#define CBS_ASN1_TAG_SHIFT 24 | | ------------------ ------------------ | Branch (299:9): [True: 83, False: 157] ------------------ 300| | // Small tag numbers should have used low tag number form, even in BER. 301| 376| v < 0x1f) { ------------------ | Branch (301:9): [True: 7, False: 150] ------------------ 302| 226| return 0; 303| 226| } 304| 150| tag_number = (CBS_ASN1_TAG)v; 305| 150| } 306| | 307| 10.4k| tag |= tag_number; 308| | 309| | // Tag [UNIVERSAL 0] is reserved for use by the encoding. Reject it here to 310| | // avoid some ambiguity around ANY values and BER indefinite-length EOCs. See 311| | // https://crbug.com/boringssl/455. 312| 10.4k| if ((tag & ~CBS_ASN1_CONSTRUCTED) == 0) { ------------------ | | 196| 10.4k|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT) | | ------------------ | | | | 193| 10.4k|#define CBS_ASN1_TAG_SHIFT 24 | | ------------------ ------------------ | Branch (312:7): [True: 14, False: 10.4k] ------------------ 313| 14| return 0; 314| 14| } 315| | 316| 10.4k| *out = tag; 317| 10.4k| return 1; 318| 10.4k|} cbs.c:parse_base128_integer: 257| 376|static int parse_base128_integer(CBS *cbs, uint64_t *out) { 258| 376| uint64_t v = 0; 259| 376| uint8_t b; 260| 2.22k| do { 261| 2.22k| if (!CBS_get_u8(cbs, &b)) { ------------------ | Branch (261:9): [True: 131, False: 2.09k] ------------------ 262| 131| return 0; 263| 131| } 264| 2.09k| if ((v >> (64 - 7)) != 0) { ------------------ | Branch (264:9): [True: 4, False: 2.09k] ------------------ 265| | // The value is too large. 266| 4| return 0; 267| 4| } 268| 2.09k| if (v == 0 && b == 0x80) { ------------------ | Branch (268:9): [True: 375, False: 1.71k] | Branch (268:19): [True: 1, False: 374] ------------------ 269| | // The value must be minimally encoded. 270| 1| return 0; 271| 1| } 272| 2.09k| v = (v << 7) | (b & 0x7f); 273| | 274| | // Values end at an octet with the high bit cleared. 275| 2.09k| } while (b & 0x80); ------------------ | Branch (275:12): [True: 1.85k, False: 240] ------------------ 276| | 277| 240| *out = v; 278| 240| return 1; 279| 376|} OPENSSL_cpuid_setup: 153| 2|void OPENSSL_cpuid_setup(void) { 154| | // Determine the vendor and maximum input value. 155| 2| uint32_t eax, ebx, ecx, edx; 156| 2| OPENSSL_cpuid(&eax, &ebx, &ecx, &edx, 0); 157| | 158| 2| uint32_t num_ids = eax; 159| | 160| 2| int is_intel = ebx == 0x756e6547 /* Genu */ && ------------------ | Branch (160:18): [True: 2, False: 0] ------------------ 161| 2| edx == 0x49656e69 /* ineI */ && ------------------ | Branch (161:18): [True: 2, False: 0] ------------------ 162| 2| ecx == 0x6c65746e /* ntel */; ------------------ | Branch (162:18): [True: 2, False: 0] ------------------ 163| 2| int is_amd = ebx == 0x68747541 /* Auth */ && ------------------ | Branch (163:16): [True: 0, False: 2] ------------------ 164| 2| edx == 0x69746e65 /* enti */ && ------------------ | Branch (164:16): [True: 0, False: 0] ------------------ 165| 2| ecx == 0x444d4163 /* cAMD */; ------------------ | Branch (165:16): [True: 0, False: 0] ------------------ 166| | 167| 2| uint32_t extended_features[2] = {0}; 168| 2| if (num_ids >= 7) { ------------------ | Branch (168:7): [True: 2, False: 0] ------------------ 169| 2| OPENSSL_cpuid(&eax, &ebx, &ecx, &edx, 7); 170| 2| extended_features[0] = ebx; 171| 2| extended_features[1] = ecx; 172| 2| } 173| | 174| 2| OPENSSL_cpuid(&eax, &ebx, &ecx, &edx, 1); 175| | 176| 2| if (is_amd) { ------------------ | Branch (176:7): [True: 0, False: 2] ------------------ 177| | // See https://www.amd.com/system/files/TechDocs/25481.pdf, page 10. 178| 0| const uint32_t base_family = (eax >> 8) & 15; 179| 0| const uint32_t base_model = (eax >> 4) & 15; 180| | 181| 0| uint32_t family = base_family; 182| 0| uint32_t model = base_model; 183| 0| if (base_family == 0xf) { ------------------ | Branch (183:9): [True: 0, False: 0] ------------------ 184| 0| const uint32_t ext_family = (eax >> 20) & 255; 185| 0| family += ext_family; 186| 0| const uint32_t ext_model = (eax >> 16) & 15; 187| 0| model |= ext_model << 4; 188| 0| } 189| | 190| 0| if (family < 0x17 || (family == 0x17 && 0x70 <= model && model <= 0x7f)) { ------------------ | Branch (190:9): [True: 0, False: 0] | Branch (190:27): [True: 0, False: 0] | Branch (190:45): [True: 0, False: 0] | Branch (190:62): [True: 0, False: 0] ------------------ 191| | // Disable RDRAND on AMD families before 0x17 (Zen) due to reported 192| | // failures after suspend. 193| | // https://bugzilla.redhat.com/show_bug.cgi?id=1150286 194| | // Also disable for family 0x17, models 0x70–0x7f, due to possible RDRAND 195| | // failures there too. 196| 0| ecx &= ~(1u << 30); 197| 0| } 198| 0| } 199| | 200| | // Force the hyper-threading bit so that the more conservative path is always 201| | // chosen. 202| 2| edx |= 1u << 28; 203| | 204| | // Reserved bit #20 was historically repurposed to control the in-memory 205| | // representation of RC4 state. Always set it to zero. 206| 2| edx &= ~(1u << 20); 207| | 208| | // Reserved bit #30 is repurposed to signal an Intel CPU. 209| 2| if (is_intel) { ------------------ | Branch (209:7): [True: 2, False: 0] ------------------ 210| 2| edx |= (1u << 30); 211| | 212| | // Clear the XSAVE bit on Knights Landing to mimic Silvermont. This enables 213| | // some Silvermont-specific codepaths which perform better. See OpenSSL 214| | // commit 64d92d74985ebb3d0be58a9718f9e080a14a8e7f. 215| 2| if ((eax & 0x0fff0ff0) == 0x00050670 /* Knights Landing */ || ------------------ | Branch (215:9): [True: 0, False: 2] ------------------ 216| 2| (eax & 0x0fff0ff0) == 0x00080650 /* Knights Mill (per SDE) */) { ------------------ | Branch (216:9): [True: 0, False: 2] ------------------ 217| 0| ecx &= ~(1u << 26); 218| 0| } 219| 2| } else { 220| 0| edx &= ~(1u << 30); 221| 0| } 222| | 223| | // The SDBG bit is repurposed to denote AMD XOP support. Don't ever use AMD 224| | // XOP code paths. 225| 2| ecx &= ~(1u << 11); 226| | 227| 2| uint64_t xcr0 = 0; 228| 2| if (ecx & (1u << 27)) { ------------------ | Branch (228:7): [True: 2, False: 0] ------------------ 229| | // XCR0 may only be queried if the OSXSAVE bit is set. 230| 2| xcr0 = OPENSSL_xgetbv(0); 231| 2| } 232| | // See Intel manual, volume 1, section 14.3. 233| 2| if ((xcr0 & 6) != 6) { ------------------ | Branch (233:7): [True: 0, False: 2] ------------------ 234| | // YMM registers cannot be used. 235| 0| ecx &= ~(1u << 28); // AVX 236| 0| ecx &= ~(1u << 12); // FMA 237| 0| ecx &= ~(1u << 11); // AMD XOP 238| | // Clear AVX2 and AVX512* bits. 239| | // 240| | // TODO(davidben): Should bits 17 and 26-28 also be cleared? Upstream 241| | // doesn't clear those. 242| 0| extended_features[0] &= 243| 0| ~((1u << 5) | (1u << 16) | (1u << 21) | (1u << 30) | (1u << 31)); 244| 0| } 245| | // See Intel manual, volume 1, section 15.2. 246| 2| if ((xcr0 & 0xe6) != 0xe6) { ------------------ | Branch (246:7): [True: 2, False: 0] ------------------ 247| | // Clear AVX512F. Note we don't touch other AVX512 extensions because they 248| | // can be used with YMM. 249| 2| extended_features[0] &= ~(1u << 16); 250| 2| } 251| | 252| | // Disable ADX instructions on Knights Landing. See OpenSSL commit 253| | // 64d92d74985ebb3d0be58a9718f9e080a14a8e7f. 254| 2| if ((ecx & (1u << 26)) == 0) { ------------------ | Branch (254:7): [True: 0, False: 2] ------------------ 255| 0| extended_features[0] &= ~(1u << 19); 256| 0| } 257| | 258| 2| OPENSSL_ia32cap_P[0] = edx; 259| 2| OPENSSL_ia32cap_P[1] = ecx; 260| 2| OPENSSL_ia32cap_P[2] = extended_features[0]; 261| 2| OPENSSL_ia32cap_P[3] = extended_features[1]; 262| | 263| 2| const char *env1, *env2; 264| 2| env1 = getenv("OPENSSL_ia32cap"); 265| 2| if (env1 == NULL) { ------------------ | Branch (265:7): [True: 2, False: 0] ------------------ 266| 2| return; 267| 2| } 268| | 269| | // OPENSSL_ia32cap can contain zero, one or two values, separated with a ':'. 270| | // Each value is a 64-bit, unsigned value which may start with "0x" to 271| | // indicate a hex value. Prior to the 64-bit value, a '~' or '|' may be given. 272| | // 273| | // If the '~' prefix is present: 274| | // the value is inverted and ANDed with the probed CPUID result 275| | // If the '|' prefix is present: 276| | // the value is ORed with the probed CPUID result 277| | // Otherwise: 278| | // the value is taken as the result of the CPUID 279| | // 280| | // The first value determines OPENSSL_ia32cap_P[0] and [1]. The second [2] 281| | // and [3]. 282| | 283| 0| handle_cpu_env(&OPENSSL_ia32cap_P[0], env1); 284| 0| env2 = strchr(env1, ':'); 285| 0| if (env2 != NULL) { ------------------ | Branch (285:7): [True: 0, False: 0] ------------------ 286| 0| handle_cpu_env(&OPENSSL_ia32cap_P[2], env2 + 1); 287| 0| } 288| 0|} cpu_intel.c:OPENSSL_cpuid: 80| 6| uint32_t *out_ecx, uint32_t *out_edx, uint32_t leaf) { 81| |#if defined(_MSC_VER) 82| | int tmp[4]; 83| | __cpuid(tmp, (int)leaf); 84| | *out_eax = (uint32_t)tmp[0]; 85| | *out_ebx = (uint32_t)tmp[1]; 86| | *out_ecx = (uint32_t)tmp[2]; 87| | *out_edx = (uint32_t)tmp[3]; 88| |#elif defined(__pic__) && defined(OPENSSL_32_BIT) 89| | // Inline assembly may not clobber the PIC register. For 32-bit, this is EBX. 90| | // See https://gcc.gnu.org/bugzilla/show_bug.cgi?id=47602. 91| | __asm__ volatile ( 92| | "xor %%ecx, %%ecx\n" 93| | "mov %%ebx, %%edi\n" 94| | "cpuid\n" 95| | "xchg %%edi, %%ebx\n" 96| | : "=a"(*out_eax), "=D"(*out_ebx), "=c"(*out_ecx), "=d"(*out_edx) 97| | : "a"(leaf) 98| | ); 99| |#else 100| 6| __asm__ volatile ( 101| 6| "xor %%ecx, %%ecx\n" 102| 6| "cpuid\n" 103| 6| : "=a"(*out_eax), "=b"(*out_ebx), "=c"(*out_ecx), "=d"(*out_edx) 104| 6| : "a"(leaf) 105| 6| ); 106| 6|#endif 107| 6|} cpu_intel.c:OPENSSL_xgetbv: 111| 2|static uint64_t OPENSSL_xgetbv(uint32_t xcr) { 112| |#if defined(_MSC_VER) 113| | return (uint64_t)_xgetbv(xcr); 114| |#else 115| 2| uint32_t eax, edx; 116| 2| __asm__ volatile ("xgetbv" : "=a"(eax), "=d"(edx) : "c"(xcr)); 117| 2| return (((uint64_t)edx) << 32) | eax; 118| 2|#endif 119| 2|} crypto.c:do_library_init: 151| 2|static void OPENSSL_CDECL do_library_init(void) { 152| | // WARNING: this function may only configure the capability variables. See the 153| | // note above about the linker bug. 154| 2|#if defined(NEED_CPUID) 155| 2| OPENSSL_cpuid_setup(); 156| 2|#endif 157| 2|} DSA_new: 90| 463|DSA *DSA_new(void) { 91| 463| DSA *dsa = OPENSSL_malloc(sizeof(DSA)); 92| 463| if (dsa == NULL) { ------------------ | Branch (92:7): [True: 0, False: 463] ------------------ 93| 0| return NULL; 94| 0| } 95| | 96| 463| OPENSSL_memset(dsa, 0, sizeof(DSA)); 97| | 98| 463| dsa->references = 1; 99| | 100| 463| CRYPTO_MUTEX_init(&dsa->method_mont_lock); 101| 463| CRYPTO_new_ex_data(&dsa->ex_data); 102| | 103| 463| return dsa; 104| 463|} DSA_free: 106| 812|void DSA_free(DSA *dsa) { 107| 812| if (dsa == NULL) { ------------------ | Branch (107:7): [True: 349, False: 463] ------------------ 108| 349| return; 109| 349| } 110| | 111| 463| if (!CRYPTO_refcount_dec_and_test_zero(&dsa->references)) { ------------------ | Branch (111:7): [True: 0, False: 463] ------------------ 112| 0| return; 113| 0| } 114| | 115| 463| CRYPTO_free_ex_data(&g_ex_data_class, dsa, &dsa->ex_data); 116| | 117| 463| BN_clear_free(dsa->p); 118| 463| BN_clear_free(dsa->q); 119| 463| BN_clear_free(dsa->g); 120| 463| BN_clear_free(dsa->pub_key); 121| 463| BN_clear_free(dsa->priv_key); 122| 463| BN_MONT_CTX_free(dsa->method_mont_p); 123| 463| BN_MONT_CTX_free(dsa->method_mont_q); 124| 463| CRYPTO_MUTEX_cleanup(&dsa->method_mont_lock); 125| 463| OPENSSL_free(dsa); 126| 463|} dsa_check_key: 73| 154|int dsa_check_key(const DSA *dsa) { 74| 154| if (!dsa->p || !dsa->q || !dsa->g) { ------------------ | Branch (74:7): [True: 0, False: 154] | Branch (74:18): [True: 0, False: 154] | Branch (74:29): [True: 0, False: 154] ------------------ 75| 0| OPENSSL_PUT_ERROR(DSA, DSA_R_MISSING_PARAMETERS); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 76| 0| return 0; 77| 0| } 78| | 79| | // Fully checking for invalid DSA groups is expensive, so security and 80| | // correctness of the signature scheme depend on how |dsa| was computed. I.e. 81| | // we leave "assurance of domain parameter validity" from FIPS 186-4 to the 82| | // caller. However, we check bounds on all values to avoid DoS vectors even 83| | // when domain parameters are invalid. In particular, signing will infinite 84| | // loop if |g| is zero. 85| 154| if (BN_is_negative(dsa->p) || BN_is_negative(dsa->q) || BN_is_zero(dsa->p) || ------------------ | Branch (85:7): [True: 0, False: 154] | Branch (85:33): [True: 0, False: 154] | Branch (85:59): [True: 2, False: 152] ------------------ 86| 154| BN_is_zero(dsa->q) || !BN_is_odd(dsa->p) || !BN_is_odd(dsa->q) || ------------------ | Branch (86:7): [True: 1, False: 151] | Branch (86:29): [True: 11, False: 140] | Branch (86:51): [True: 7, False: 133] ------------------ 87| | // |q| must be a prime divisor of |p - 1|, which implies |q < p|. 88| 154| BN_cmp(dsa->q, dsa->p) >= 0 || ------------------ | Branch (88:7): [True: 8, False: 125] ------------------ 89| | // |g| is in the multiplicative group of |p|. 90| 154| BN_is_negative(dsa->g) || BN_is_zero(dsa->g) || ------------------ | Branch (90:7): [True: 0, False: 125] | Branch (90:33): [True: 4, False: 121] ------------------ 91| 154| BN_cmp(dsa->g, dsa->p) >= 0) { ------------------ | Branch (91:7): [True: 82, False: 39] ------------------ 92| 115| OPENSSL_PUT_ERROR(DSA, DSA_R_INVALID_PARAMETERS); ------------------ | | 441| 115| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 93| 115| return 0; 94| 115| } 95| | 96| | // FIPS 186-4 allows only three different sizes for q. 97| 39| unsigned q_bits = BN_num_bits(dsa->q); 98| 39| if (q_bits != 160 && q_bits != 224 && q_bits != 256) { ------------------ | Branch (98:7): [True: 26, False: 13] | Branch (98:24): [True: 26, False: 0] | Branch (98:41): [True: 18, False: 8] ------------------ 99| 18| OPENSSL_PUT_ERROR(DSA, DSA_R_BAD_Q_VALUE); ------------------ | | 441| 18| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 100| 18| return 0; 101| 18| } 102| | 103| | // Bound |dsa->p| to avoid a DoS vector. Note this limit is much larger than 104| | // the one in FIPS 186-4, which only allows L = 1024, 2048, and 3072. 105| 21| if (BN_num_bits(dsa->p) > OPENSSL_DSA_MAX_MODULUS_BITS) { ------------------ | | 68| 21|#define OPENSSL_DSA_MAX_MODULUS_BITS 10000 ------------------ | Branch (105:7): [True: 0, False: 21] ------------------ 106| 0| OPENSSL_PUT_ERROR(DSA, DSA_R_MODULUS_TOO_LARGE); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 107| 0| return 0; 108| 0| } 109| | 110| 21| if (dsa->pub_key != NULL) { ------------------ | Branch (110:7): [True: 0, False: 21] ------------------ 111| | // The public key is also in the multiplicative group of |p|. 112| 0| if (BN_is_negative(dsa->pub_key) || BN_is_zero(dsa->pub_key) || ------------------ | Branch (112:9): [True: 0, False: 0] | Branch (112:41): [True: 0, False: 0] ------------------ 113| 0| BN_cmp(dsa->pub_key, dsa->p) >= 0) { ------------------ | Branch (113:9): [True: 0, False: 0] ------------------ 114| 0| OPENSSL_PUT_ERROR(DSA, DSA_R_INVALID_PARAMETERS); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 115| 0| return 0; 116| 0| } 117| 0| } 118| | 119| 21| if (dsa->priv_key != NULL) { ------------------ | Branch (119:7): [True: 0, False: 21] ------------------ 120| | // The private key is a non-zero element of the scalar field, determined by 121| | // |q|. 122| 0| if (BN_is_negative(dsa->priv_key) || BN_is_zero(dsa->priv_key) || ------------------ | Branch (122:9): [True: 0, False: 0] | Branch (122:42): [True: 0, False: 0] ------------------ 123| 0| BN_cmp(dsa->priv_key, dsa->q) >= 0) { ------------------ | Branch (123:9): [True: 0, False: 0] ------------------ 124| 0| OPENSSL_PUT_ERROR(DSA, DSA_R_INVALID_PARAMETERS); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 125| 0| return 0; 126| 0| } 127| 0| } 128| | 129| 21| return 1; 130| 21|} DSA_parse_parameters: 218| 176|DSA *DSA_parse_parameters(CBS *cbs) { 219| 176| DSA *ret = DSA_new(); 220| 176| if (ret == NULL) { ------------------ | Branch (220:7): [True: 0, False: 176] ------------------ 221| 0| return NULL; 222| 0| } 223| 176| CBS child; 224| 176| if (!CBS_get_asn1(cbs, &child, CBS_ASN1_SEQUENCE) || ------------------ | | 222| 176|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED) | | ------------------ | | | | 196| 176|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT) | | | | ------------------ | | | | | | 193| 176|#define CBS_ASN1_TAG_SHIFT 24 | | | | ------------------ | | ------------------ ------------------ | Branch (224:7): [True: 3, False: 173] ------------------ 225| 176| !parse_integer(&child, &ret->p) || ------------------ | Branch (225:7): [True: 1, False: 172] ------------------ 226| 176| !parse_integer(&child, &ret->q) || ------------------ | Branch (226:7): [True: 6, False: 166] ------------------ 227| 176| !parse_integer(&child, &ret->g) || ------------------ | Branch (227:7): [True: 4, False: 162] ------------------ 228| 176| CBS_len(&child) != 0) { ------------------ | Branch (228:7): [True: 8, False: 154] ------------------ 229| 22| OPENSSL_PUT_ERROR(DSA, DSA_R_DECODE_ERROR); ------------------ | | 441| 22| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 230| 22| goto err; 231| 22| } 232| 154| if (!dsa_check_key(ret)) { ------------------ | Branch (232:7): [True: 133, False: 21] ------------------ 233| 133| goto err; 234| 133| } 235| 21| return ret; 236| | 237| 155|err: 238| 155| DSA_free(ret); 239| 155| return NULL; 240| 154|} DSA_marshal_parameters: 242| 15|int DSA_marshal_parameters(CBB *cbb, const DSA *dsa) { 243| 15| CBB child; 244| 15| if (!CBB_add_asn1(cbb, &child, CBS_ASN1_SEQUENCE) || ------------------ | | 222| 15|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED) | | ------------------ | | | | 196| 15|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT) | | | | ------------------ | | | | | | 193| 15|#define CBS_ASN1_TAG_SHIFT 24 | | | | ------------------ | | ------------------ ------------------ | Branch (244:7): [True: 0, False: 15] ------------------ 245| 15| !marshal_integer(&child, dsa->p) || ------------------ | Branch (245:7): [True: 0, False: 15] ------------------ 246| 15| !marshal_integer(&child, dsa->q) || ------------------ | Branch (246:7): [True: 0, False: 15] ------------------ 247| 15| !marshal_integer(&child, dsa->g) || ------------------ | Branch (247:7): [True: 0, False: 15] ------------------ 248| 15| !CBB_flush(cbb)) { ------------------ | Branch (248:7): [True: 0, False: 15] ------------------ 249| 0| OPENSSL_PUT_ERROR(DSA, DSA_R_ENCODE_ERROR); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 250| 0| return 0; 251| 0| } 252| 15| return 1; 253| 15|} dsa_asn1.c:parse_integer: 132| 511|static int parse_integer(CBS *cbs, BIGNUM **out) { 133| 511| assert(*out == NULL); 134| 511| *out = BN_new(); 135| 511| if (*out == NULL) { ------------------ | Branch (135:7): [True: 0, False: 511] ------------------ 136| 0| return 0; 137| 0| } 138| 511| return BN_parse_asn1_unsigned(cbs, *out); 139| 511|} dsa_asn1.c:marshal_integer: 141| 45|static int marshal_integer(CBB *cbb, BIGNUM *bn) { 142| 45| if (bn == NULL) { ------------------ | Branch (142:7): [True: 0, False: 45] ------------------ 143| | // A DSA object may be missing some components. 144| 0| OPENSSL_PUT_ERROR(DSA, ERR_R_PASSED_NULL_PARAMETER); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 145| 0| return 0; 146| 0| } 147| 45| return BN_marshal_asn1(cbb, bn); 148| 45|} EC_KEY_parse_curve_name: 324| 752|EC_GROUP *EC_KEY_parse_curve_name(CBS *cbs) { 325| 752| CBS named_curve; 326| 752| if (!CBS_get_asn1(cbs, &named_curve, CBS_ASN1_OBJECT)) { ------------------ | | 219| 752|#define CBS_ASN1_OBJECT 0x6u ------------------ | Branch (326:7): [True: 1, False: 751] ------------------ 327| 1| OPENSSL_PUT_ERROR(EC, EC_R_DECODE_ERROR); ------------------ | | 441| 1| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 328| 1| return NULL; 329| 1| } 330| | 331| | // Look for a matching curve. 332| 751| const struct built_in_curves *const curves = OPENSSL_built_in_curves(); 333| 2.80k| for (size_t i = 0; i < OPENSSL_NUM_BUILT_IN_CURVES; i++) { ------------------ | | 780| 2.80k|#define OPENSSL_NUM_BUILT_IN_CURVES 4 ------------------ | Branch (333:22): [True: 2.77k, False: 28] ------------------ 334| 2.77k| const struct built_in_curve *curve = &curves->curves[i]; 335| 2.77k| if (CBS_len(&named_curve) == curve->oid_len && ------------------ | Branch (335:9): [True: 1.94k, False: 827] ------------------ 336| 2.77k| OPENSSL_memcmp(CBS_data(&named_curve), curve->oid, curve->oid_len) == ------------------ | Branch (336:9): [True: 723, False: 1.22k] ------------------ 337| 1.94k| 0) { 338| 723| return EC_GROUP_new_by_curve_name(curve->nid); 339| 723| } 340| 2.77k| } 341| | 342| 28| OPENSSL_PUT_ERROR(EC, EC_R_UNKNOWN_GROUP); ------------------ | | 441| 28| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 343| 28| return NULL; 344| 751|} EC_KEY_marshal_curve_name: 346| 514|int EC_KEY_marshal_curve_name(CBB *cbb, const EC_GROUP *group) { 347| 514| int nid = EC_GROUP_get_curve_name(group); 348| 514| if (nid == NID_undef) { ------------------ | | 85| 514|#define NID_undef 0 ------------------ | Branch (348:7): [True: 0, False: 514] ------------------ 349| 0| OPENSSL_PUT_ERROR(EC, EC_R_UNKNOWN_GROUP); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 350| 0| return 0; 351| 0| } 352| | 353| 514| const struct built_in_curves *const curves = OPENSSL_built_in_curves(); 354| 1.89k| for (size_t i = 0; i < OPENSSL_NUM_BUILT_IN_CURVES; i++) { ------------------ | | 780| 1.89k|#define OPENSSL_NUM_BUILT_IN_CURVES 4 ------------------ | Branch (354:22): [True: 1.89k, False: 0] ------------------ 355| 1.89k| const struct built_in_curve *curve = &curves->curves[i]; 356| 1.89k| if (curve->nid == nid) { ------------------ | Branch (356:9): [True: 514, False: 1.37k] ------------------ 357| 514| CBB child; 358| 514| return CBB_add_asn1(cbb, &child, CBS_ASN1_OBJECT) && ------------------ | | 219| 514|#define CBS_ASN1_OBJECT 0x6u ------------------ | Branch (358:14): [True: 514, False: 0] ------------------ 359| 514| CBB_add_bytes(&child, curve->oid, curve->oid_len) && ------------------ | Branch (359:14): [True: 514, False: 0] ------------------ 360| 514| CBB_flush(cbb); ------------------ | Branch (360:14): [True: 514, False: 0] ------------------ 361| 514| } 362| 1.89k| } 363| | 364| 0| OPENSSL_PUT_ERROR(EC, EC_R_UNKNOWN_GROUP); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 365| 0| return 0; 366| 514|} EC_POINT_point2cbb: 408| 514| point_conversion_form_t form, BN_CTX *ctx) { 409| 514| size_t len = EC_POINT_point2oct(group, point, form, NULL, 0, ctx); 410| 514| if (len == 0) { ------------------ | Branch (410:7): [True: 0, False: 514] ------------------ 411| 0| return 0; 412| 0| } 413| 514| uint8_t *p; 414| 514| return CBB_add_space(out, &p, len) && ------------------ | Branch (414:10): [True: 514, False: 0] ------------------ 415| 514| EC_POINT_point2oct(group, point, form, p, len, ctx) == len; ------------------ | Branch (415:10): [True: 514, False: 0] ------------------ 416| 514|} METHOD_ref: 86| 351|void METHOD_ref(void *method_in) { 87| 351| assert(((struct openssl_method_common_st*) method_in)->is_static); 88| 351|} METHOD_unref: 90| 351|void METHOD_unref(void *method_in) { 91| 351| struct openssl_method_common_st *method = method_in; 92| | 93| 351| if (method == NULL) { ------------------ | Branch (93:7): [True: 0, False: 351] ------------------ 94| 0| return; 95| 0| } 96| 351| assert(method->is_static); 97| 351|} ERR_peek_last_error: 328| 160|uint32_t ERR_peek_last_error(void) { 329| 160| return get_error_values(0 /* peek */, 1 /* top */, NULL, NULL, NULL, NULL); 330| 160|} ERR_clear_error: 341| 3.14k|void ERR_clear_error(void) { 342| 3.14k| ERR_STATE *const state = err_get_state(); 343| 3.14k| unsigned i; 344| | 345| 3.14k| if (state == NULL) { ------------------ | Branch (345:7): [True: 0, False: 3.14k] ------------------ 346| 0| return; 347| 0| } 348| | 349| 53.5k| for (i = 0; i < ERR_NUM_ERRORS; i++) { ------------------ | | 477| 53.5k|#define ERR_NUM_ERRORS 16 ------------------ | Branch (349:15): [True: 50.3k, False: 3.14k] ------------------ 350| 50.3k| err_clear(&state->errors[i]); 351| 50.3k| } 352| 3.14k| free(state->to_free); 353| 3.14k| state->to_free = NULL; 354| | 355| 3.14k| state->top = state->bottom = 0; 356| 3.14k|} ERR_put_error: 657| 2.52k| unsigned line) { 658| 2.52k| ERR_STATE *const state = err_get_state(); 659| 2.52k| struct err_error_st *error; 660| | 661| 2.52k| if (state == NULL) { ------------------ | Branch (661:7): [True: 0, False: 2.52k] ------------------ 662| 0| return; 663| 0| } 664| | 665| 2.52k| if (library == ERR_LIB_SYS && reason == 0) { ------------------ | Branch (665:7): [True: 0, False: 2.52k] | Branch (665:33): [True: 0, False: 0] ------------------ 666| |#if defined(OPENSSL_WINDOWS) 667| | reason = GetLastError(); 668| |#else 669| 0| reason = errno; 670| 0|#endif 671| 0| } 672| | 673| 2.52k| state->top = (state->top + 1) % ERR_NUM_ERRORS; ------------------ | | 477| 2.52k|#define ERR_NUM_ERRORS 16 ------------------ 674| 2.52k| if (state->top == state->bottom) { ------------------ | Branch (674:7): [True: 0, False: 2.52k] ------------------ 675| 0| state->bottom = (state->bottom + 1) % ERR_NUM_ERRORS; ------------------ | | 477| 0|#define ERR_NUM_ERRORS 16 ------------------ 676| 0| } 677| | 678| 2.52k| error = &state->errors[state->top]; 679| 2.52k| err_clear(error); 680| 2.52k| error->file = file; 681| 2.52k| error->line = line; 682| 2.52k| error->packed = ERR_PACK(library, reason); ------------------ | | 480| 2.52k| (((((uint32_t)(lib)) & 0xff) << 24) | ((((uint32_t)(reason)) & 0xfff))) ------------------ 683| 2.52k|} err.c:get_error_values: 231| 160| const char **data, int *flags) { 232| 160| unsigned i = 0; 233| 160| ERR_STATE *state; 234| 160| struct err_error_st *error; 235| 160| uint32_t ret; 236| | 237| 160| state = err_get_state(); 238| 160| if (state == NULL || state->bottom == state->top) { ------------------ | Branch (238:7): [True: 0, False: 160] | Branch (238:24): [True: 0, False: 160] ------------------ 239| 0| return 0; 240| 0| } 241| | 242| 160| if (top) { ------------------ | Branch (242:7): [True: 160, False: 0] ------------------ 243| 160| assert(!inc); 244| | // last error 245| 160| i = state->top; 246| 160| } else { 247| 0| i = (state->bottom + 1) % ERR_NUM_ERRORS; ------------------ | | 477| 0|#define ERR_NUM_ERRORS 16 ------------------ 248| 0| } 249| | 250| 160| error = &state->errors[i]; 251| 160| ret = error->packed; 252| | 253| 160| if (file != NULL && line != NULL) { ------------------ | Branch (253:7): [True: 0, False: 160] | Branch (253:23): [True: 0, False: 0] ------------------ 254| 0| if (error->file == NULL) { ------------------ | Branch (254:9): [True: 0, False: 0] ------------------ 255| 0| *file = "NA"; 256| 0| *line = 0; 257| 0| } else { 258| 0| *file = error->file; 259| 0| *line = error->line; 260| 0| } 261| 0| } 262| | 263| 160| if (data != NULL) { ------------------ | Branch (263:7): [True: 0, False: 160] ------------------ 264| 0| if (error->data == NULL) { ------------------ | Branch (264:9): [True: 0, False: 0] ------------------ 265| 0| *data = ""; 266| 0| if (flags != NULL) { ------------------ | Branch (266:11): [True: 0, False: 0] ------------------ 267| 0| *flags = 0; 268| 0| } 269| 0| } else { 270| 0| *data = error->data; 271| 0| if (flags != NULL) { ------------------ | Branch (271:11): [True: 0, False: 0] ------------------ 272| | // Without |ERR_FLAG_MALLOCED|, rust-openssl assumes the string has a 273| | // static lifetime. In both cases, we retain ownership of the string, 274| | // and the caller is not expected to free it. 275| 0| *flags = ERR_FLAG_STRING | ERR_FLAG_MALLOCED; ------------------ | | 188| 0|#define ERR_FLAG_STRING 1 ------------------ *flags = ERR_FLAG_STRING | ERR_FLAG_MALLOCED; ------------------ | | 197| 0|#define ERR_FLAG_MALLOCED 2 ------------------ 276| 0| } 277| | // If this error is being removed, take ownership of data from 278| | // the error. The semantics are such that the caller doesn't 279| | // take ownership either. Instead the error system takes 280| | // ownership and retains it until the next call that affects the 281| | // error queue. 282| 0| if (inc) { ------------------ | Branch (282:11): [True: 0, False: 0] ------------------ 283| 0| if (error->data != NULL) { ------------------ | Branch (283:13): [True: 0, False: 0] ------------------ 284| 0| free(state->to_free); 285| 0| state->to_free = error->data; 286| 0| } 287| 0| error->data = NULL; 288| 0| } 289| 0| } 290| 0| } 291| | 292| 160| if (inc) { ------------------ | Branch (292:7): [True: 0, False: 160] ------------------ 293| 0| assert(!top); 294| 0| err_clear(error); 295| 0| state->bottom = i; 296| 0| } 297| | 298| 160| return ret; 299| 160|} err.c:err_get_state: 213| 5.83k|static ERR_STATE *err_get_state(void) { 214| 5.83k| ERR_STATE *state = CRYPTO_get_thread_local(OPENSSL_THREAD_LOCAL_ERR); 215| 5.83k| if (state == NULL) { ------------------ | Branch (215:7): [True: 1, False: 5.82k] ------------------ 216| 1| state = malloc(sizeof(ERR_STATE)); 217| 1| if (state == NULL) { ------------------ | Branch (217:9): [True: 0, False: 1] ------------------ 218| 0| return NULL; 219| 0| } 220| 1| OPENSSL_memset(state, 0, sizeof(ERR_STATE)); 221| 1| if (!CRYPTO_set_thread_local(OPENSSL_THREAD_LOCAL_ERR, state, ------------------ | Branch (221:9): [True: 0, False: 1] ------------------ 222| 1| err_state_free)) { 223| 0| return NULL; 224| 0| } 225| 1| } 226| | 227| 5.83k| return state; 228| 5.83k|} err.c:err_clear: 168| 52.8k|static void err_clear(struct err_error_st *error) { 169| 52.8k| free(error->data); 170| 52.8k| OPENSSL_memset(error, 0, sizeof(struct err_error_st)); 171| 52.8k|} EVP_PKEY_new: 83| 1.61k|EVP_PKEY *EVP_PKEY_new(void) { 84| 1.61k| EVP_PKEY *ret; 85| | 86| 1.61k| ret = OPENSSL_malloc(sizeof(EVP_PKEY)); 87| 1.61k| if (ret == NULL) { ------------------ | Branch (87:7): [True: 0, False: 1.61k] ------------------ 88| 0| return NULL; 89| 0| } 90| | 91| 1.61k| OPENSSL_memset(ret, 0, sizeof(EVP_PKEY)); 92| 1.61k| ret->type = EVP_PKEY_NONE; ------------------ | | 174| 1.61k|#define EVP_PKEY_NONE NID_undef | | ------------------ | | | | 85| 1.61k|#define NID_undef 0 | | ------------------ ------------------ 93| 1.61k| ret->references = 1; 94| | 95| 1.61k| return ret; 96| 1.61k|} EVP_PKEY_free: 106| 1.61k|void EVP_PKEY_free(EVP_PKEY *pkey) { 107| 1.61k| if (pkey == NULL) { ------------------ | Branch (107:7): [True: 0, False: 1.61k] ------------------ 108| 0| return; 109| 0| } 110| | 111| 1.61k| if (!CRYPTO_refcount_dec_and_test_zero(&pkey->references)) { ------------------ | Branch (111:7): [True: 0, False: 1.61k] ------------------ 112| 0| return; 113| 0| } 114| | 115| 1.61k| free_it(pkey); 116| 1.61k| OPENSSL_free(pkey); 117| 1.61k|} EVP_PKEY_assign_RSA: 248| 23|int EVP_PKEY_assign_RSA(EVP_PKEY *pkey, RSA *key) { 249| 23| return EVP_PKEY_assign(pkey, EVP_PKEY_RSA, key); ------------------ | | 175| 23|#define EVP_PKEY_RSA NID_rsaEncryption | | ------------------ | | | | 114| 23|#define NID_rsaEncryption 6 | | ------------------ ------------------ 250| 23|} EVP_PKEY_assign_DSA: 276| 269|int EVP_PKEY_assign_DSA(EVP_PKEY *pkey, DSA *key) { 277| 269| return EVP_PKEY_assign(pkey, EVP_PKEY_DSA, key); ------------------ | | 177| 269|#define EVP_PKEY_DSA NID_dsa | | ------------------ | | | | 612| 269|#define NID_dsa 116 | | ------------------ ------------------ 278| 269|} EVP_PKEY_assign_EC_KEY: 304| 514|int EVP_PKEY_assign_EC_KEY(EVP_PKEY *pkey, EC_KEY *key) { 305| 514| return EVP_PKEY_assign(pkey, EVP_PKEY_EC, key); ------------------ | | 178| 514|#define EVP_PKEY_EC NID_X9_62_id_ecPublicKey | | ------------------ | | | | 1886| 514|#define NID_X9_62_id_ecPublicKey 408 | | ------------------ ------------------ 306| 514|} EVP_PKEY_assign: 327| 806|int EVP_PKEY_assign(EVP_PKEY *pkey, int type, void *key) { 328| 806| if (!EVP_PKEY_set_type(pkey, type)) { ------------------ | Branch (328:7): [True: 0, False: 806] ------------------ 329| 0| return 0; 330| 0| } 331| 806| pkey->pkey = key; 332| 806| return key != NULL; 333| 806|} EVP_PKEY_set_type: 335| 2.41k|int EVP_PKEY_set_type(EVP_PKEY *pkey, int type) { 336| 2.41k| const EVP_PKEY_ASN1_METHOD *ameth; 337| | 338| 2.41k| if (pkey && pkey->pkey) { ------------------ | Branch (338:7): [True: 2.41k, False: 0] | Branch (338:15): [True: 0, False: 2.41k] ------------------ 339| 0| free_it(pkey); 340| 0| } 341| | 342| 2.41k| ameth = evp_pkey_asn1_find(type); 343| 2.41k| if (ameth == NULL) { ------------------ | Branch (343:7): [True: 0, False: 2.41k] ------------------ 344| 0| OPENSSL_PUT_ERROR(EVP, EVP_R_UNSUPPORTED_ALGORITHM); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 345| 0| ERR_add_error_dataf("algorithm %d", type); 346| 0| return 0; 347| 0| } 348| | 349| 2.41k| if (pkey) { ------------------ | Branch (349:7): [True: 2.41k, False: 0] ------------------ 350| 2.41k| pkey->ameth = ameth; 351| 2.41k| pkey->type = pkey->ameth->pkey_id; 352| 2.41k| } 353| | 354| 2.41k| return 1; 355| 2.41k|} evp.c:free_it: 98| 1.61k|static void free_it(EVP_PKEY *pkey) { 99| 1.61k| if (pkey->ameth && pkey->ameth->pkey_free) { ------------------ | Branch (99:7): [True: 1.61k, False: 0] | Branch (99:22): [True: 1.61k, False: 0] ------------------ 100| 1.61k| pkey->ameth->pkey_free(pkey); 101| 1.61k| pkey->pkey = NULL; 102| 1.61k| pkey->type = EVP_PKEY_NONE; ------------------ | | 174| 1.61k|#define EVP_PKEY_NONE NID_undef | | ------------------ | | | | 85| 1.61k|#define NID_undef 0 | | ------------------ ------------------ 103| 1.61k| } 104| 1.61k|} evp.c:evp_pkey_asn1_find: 215| 2.41k|static const EVP_PKEY_ASN1_METHOD *evp_pkey_asn1_find(int nid) { 216| 2.41k| switch (nid) { 217| 389| case EVP_PKEY_RSA: ------------------ | | 175| 389|#define EVP_PKEY_RSA NID_rsaEncryption | | ------------------ | | | | 114| 389|#define NID_rsaEncryption 6 | | ------------------ ------------------ | Branch (217:5): [True: 389, False: 2.02k] ------------------ 218| 389| return &rsa_asn1_meth; 219| 1.26k| case EVP_PKEY_EC: ------------------ | | 178| 1.26k|#define EVP_PKEY_EC NID_X9_62_id_ecPublicKey | | ------------------ | | | | 1886| 1.26k|#define NID_X9_62_id_ecPublicKey 408 | | ------------------ ------------------ | Branch (219:5): [True: 1.26k, False: 1.15k] ------------------ 220| 1.26k| return &ec_asn1_meth; 221| 732| case EVP_PKEY_DSA: ------------------ | | 177| 732|#define EVP_PKEY_DSA NID_dsa | | ------------------ | | | | 612| 732|#define NID_dsa 116 | | ------------------ ------------------ | Branch (221:5): [True: 732, False: 1.68k] ------------------ 222| 732| return &dsa_asn1_meth; 223| 16| case EVP_PKEY_ED25519: ------------------ | | 179| 16|#define EVP_PKEY_ED25519 NID_ED25519 | | ------------------ | | | | 4199| 16|#define NID_ED25519 949 | | ------------------ ------------------ | Branch (223:5): [True: 16, False: 2.40k] ------------------ 224| 16| return &ed25519_asn1_meth; 225| 15| case EVP_PKEY_X25519: ------------------ | | 180| 15|#define EVP_PKEY_X25519 NID_X25519 | | ------------------ | | | | 4195| 15|#define NID_X25519 948 | | ------------------ ------------------ | Branch (225:5): [True: 15, False: 2.40k] ------------------ 226| 15| return &x25519_asn1_meth; 227| 0| default: ------------------ | Branch (227:5): [True: 0, False: 2.41k] ------------------ 228| 0| return NULL; 229| 2.41k| } 230| 2.41k|} EVP_parse_public_key: 98| 2.31k|EVP_PKEY *EVP_parse_public_key(CBS *cbs) { 99| | // Parse the SubjectPublicKeyInfo. 100| 2.31k| CBS spki, algorithm, key; 101| 2.31k| int type; 102| 2.31k| uint8_t padding; 103| 2.31k| if (!CBS_get_asn1(cbs, &spki, CBS_ASN1_SEQUENCE) || ------------------ | | 222| 2.31k|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED) | | ------------------ | | | | 196| 2.31k|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT) | | | | ------------------ | | | | | | 193| 2.31k|#define CBS_ASN1_TAG_SHIFT 24 | | | | ------------------ | | ------------------ ------------------ | Branch (103:7): [True: 530, False: 1.78k] ------------------ 104| 2.31k| !CBS_get_asn1(&spki, &algorithm, CBS_ASN1_SEQUENCE) || ------------------ | | 222| 1.78k|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED) | | ------------------ | | | | 196| 1.78k|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT) | | | | ------------------ | | | | | | 193| 1.78k|#define CBS_ASN1_TAG_SHIFT 24 | | | | ------------------ | | ------------------ ------------------ | Branch (104:7): [True: 28, False: 1.75k] ------------------ 105| 2.31k| !CBS_get_asn1(&spki, &key, CBS_ASN1_BITSTRING) || ------------------ | | 216| 1.75k|#define CBS_ASN1_BITSTRING 0x3u ------------------ | Branch (105:7): [True: 23, False: 1.73k] ------------------ 106| 2.31k| CBS_len(&spki) != 0) { ------------------ | Branch (106:7): [True: 16, False: 1.72k] ------------------ 107| 597| OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR); ------------------ | | 441| 597| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 108| 597| return NULL; 109| 597| } 110| 1.72k| if (!parse_key_type(&algorithm, &type)) { ------------------ | Branch (110:7): [True: 93, False: 1.62k] ------------------ 111| 93| OPENSSL_PUT_ERROR(EVP, EVP_R_UNSUPPORTED_ALGORITHM); ------------------ | | 441| 93| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 112| 93| return NULL; 113| 93| } 114| 1.62k| if (// Every key type defined encodes the key as a byte string with the same 115| | // conversion to BIT STRING. 116| 1.62k| !CBS_get_u8(&key, &padding) || ------------------ | Branch (116:7): [True: 5, False: 1.62k] ------------------ 117| 1.62k| padding != 0) { ------------------ | Branch (117:7): [True: 10, False: 1.61k] ------------------ 118| 15| OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR); ------------------ | | 441| 15| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 119| 15| return NULL; 120| 15| } 121| | 122| | // Set up an |EVP_PKEY| of the appropriate type. 123| 1.61k| EVP_PKEY *ret = EVP_PKEY_new(); 124| 1.61k| if (ret == NULL || ------------------ | Branch (124:7): [True: 0, False: 1.61k] ------------------ 125| 1.61k| !EVP_PKEY_set_type(ret, type)) { ------------------ | Branch (125:7): [True: 0, False: 1.61k] ------------------ 126| 0| goto err; 127| 0| } 128| | 129| | // Call into the type-specific SPKI decoding function. 130| 1.61k| if (ret->ameth->pub_decode == NULL) { ------------------ | Branch (130:7): [True: 0, False: 1.61k] ------------------ 131| 0| OPENSSL_PUT_ERROR(EVP, EVP_R_UNSUPPORTED_ALGORITHM); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 132| 0| goto err; 133| 0| } 134| 1.61k| if (!ret->ameth->pub_decode(ret, &algorithm, &key)) { ------------------ | Branch (134:7): [True: 804, False: 808] ------------------ 135| 804| goto err; 136| 804| } 137| | 138| 808| return ret; 139| | 140| 804|err: 141| 804| EVP_PKEY_free(ret); 142| 804| return NULL; 143| 1.61k|} EVP_marshal_public_key: 145| 808|int EVP_marshal_public_key(CBB *cbb, const EVP_PKEY *key) { 146| 808| if (key->ameth == NULL || key->ameth->pub_encode == NULL) { ------------------ | Branch (146:7): [True: 0, False: 808] | Branch (146:29): [True: 0, False: 808] ------------------ 147| 0| OPENSSL_PUT_ERROR(EVP, EVP_R_UNSUPPORTED_ALGORITHM); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 148| 0| return 0; 149| 0| } 150| | 151| 808| return key->ameth->pub_encode(cbb, key); 152| 808|} evp_asn1.c:parse_key_type: 80| 1.72k|static int parse_key_type(CBS *cbs, int *out_type) { 81| 1.72k| CBS oid; 82| 1.72k| if (!CBS_get_asn1(cbs, &oid, CBS_ASN1_OBJECT)) { ------------------ | | 219| 1.72k|#define CBS_ASN1_OBJECT 0x6u ------------------ | Branch (82:7): [True: 3, False: 1.71k] ------------------ 83| 3| return 0; 84| 3| } 85| | 86| 3.99k| for (unsigned i = 0; i < OPENSSL_ARRAY_SIZE(kASN1Methods); i++) { ------------------ | | 221| 3.99k|#define OPENSSL_ARRAY_SIZE(array) (sizeof(array) / sizeof((array)[0])) ------------------ | Branch (86:24): [True: 3.90k, False: 90] ------------------ 87| 3.90k| const EVP_PKEY_ASN1_METHOD *method = kASN1Methods[i]; 88| 3.90k| if (CBS_len(&oid) == method->oid_len && ------------------ | Branch (88:9): [True: 2.24k, False: 1.65k] ------------------ 89| 3.90k| OPENSSL_memcmp(CBS_data(&oid), method->oid, method->oid_len) == 0) { ------------------ | Branch (89:9): [True: 1.62k, False: 621] ------------------ 90| 1.62k| *out_type = method->pkey_id; 91| 1.62k| return 1; 92| 1.62k| } 93| 3.90k| } 94| | 95| 90| return 0; 96| 1.71k|} p_dsa_asn1.c:dsa_pub_decode: 68| 463|static int dsa_pub_decode(EVP_PKEY *out, CBS *params, CBS *key) { 69| | // See RFC 3279, section 2.3.2. 70| | 71| | // Parameters may or may not be present. 72| 463| DSA *dsa; 73| 463| if (CBS_len(params) == 0) { ------------------ | Branch (73:7): [True: 287, False: 176] ------------------ 74| 287| dsa = DSA_new(); 75| 287| if (dsa == NULL) { ------------------ | Branch (75:9): [True: 0, False: 287] ------------------ 76| 0| return 0; 77| 0| } 78| 287| } else { 79| 176| dsa = DSA_parse_parameters(params); 80| 176| if (dsa == NULL || CBS_len(params) != 0) { ------------------ | Branch (80:9): [True: 155, False: 21] | Branch (80:24): [True: 4, False: 17] ------------------ 81| 159| OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR); ------------------ | | 441| 159| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 82| 159| goto err; 83| 159| } 84| 176| } 85| | 86| 304| dsa->pub_key = BN_new(); 87| 304| if (dsa->pub_key == NULL) { ------------------ | Branch (87:7): [True: 0, False: 304] ------------------ 88| 0| goto err; 89| 0| } 90| | 91| 304| if (!BN_parse_asn1_unsigned(key, dsa->pub_key) || ------------------ | Branch (91:7): [True: 24, False: 280] ------------------ 92| 304| CBS_len(key) != 0) { ------------------ | Branch (92:7): [True: 11, False: 269] ------------------ 93| 35| OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR); ------------------ | | 441| 35| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 94| 35| goto err; 95| 35| } 96| | 97| 269| EVP_PKEY_assign_DSA(out, dsa); 98| 269| return 1; 99| | 100| 194|err: 101| 194| DSA_free(dsa); 102| 194| return 0; 103| 304|} p_dsa_asn1.c:dsa_pub_encode: 105| 269|static int dsa_pub_encode(CBB *out, const EVP_PKEY *key) { 106| 269| const DSA *dsa = key->pkey; 107| 269| const int has_params = dsa->p != NULL && dsa->q != NULL && dsa->g != NULL; ------------------ | Branch (107:26): [True: 15, False: 254] | Branch (107:44): [True: 15, False: 0] | Branch (107:62): [True: 15, False: 0] ------------------ 108| | 109| | // See RFC 5480, section 2. 110| 269| CBB spki, algorithm, oid, key_bitstring; 111| 269| if (!CBB_add_asn1(out, &spki, CBS_ASN1_SEQUENCE) || ------------------ | | 222| 269|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED) | | ------------------ | | | | 196| 269|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT) | | | | ------------------ | | | | | | 193| 269|#define CBS_ASN1_TAG_SHIFT 24 | | | | ------------------ | | ------------------ ------------------ | Branch (111:7): [True: 0, False: 269] ------------------ 112| 269| !CBB_add_asn1(&spki, &algorithm, CBS_ASN1_SEQUENCE) || ------------------ | | 222| 269|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED) | | ------------------ | | | | 196| 269|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT) | | | | ------------------ | | | | | | 193| 269|#define CBS_ASN1_TAG_SHIFT 24 | | | | ------------------ | | ------------------ ------------------ | Branch (112:7): [True: 0, False: 269] ------------------ 113| 269| !CBB_add_asn1(&algorithm, &oid, CBS_ASN1_OBJECT) || ------------------ | | 219| 269|#define CBS_ASN1_OBJECT 0x6u ------------------ | Branch (113:7): [True: 0, False: 269] ------------------ 114| 269| !CBB_add_bytes(&oid, dsa_asn1_meth.oid, dsa_asn1_meth.oid_len) || ------------------ | Branch (114:7): [True: 0, False: 269] ------------------ 115| 269| (has_params && ------------------ | Branch (115:8): [True: 15, False: 254] ------------------ 116| 269| !DSA_marshal_parameters(&algorithm, dsa)) || ------------------ | Branch (116:8): [True: 0, False: 15] ------------------ 117| 269| !CBB_add_asn1(&spki, &key_bitstring, CBS_ASN1_BITSTRING) || ------------------ | | 216| 269|#define CBS_ASN1_BITSTRING 0x3u ------------------ | Branch (117:7): [True: 0, False: 269] ------------------ 118| 269| !CBB_add_u8(&key_bitstring, 0 /* padding */) || ------------------ | Branch (118:7): [True: 0, False: 269] ------------------ 119| 269| !BN_marshal_asn1(&key_bitstring, dsa->pub_key) || ------------------ | Branch (119:7): [True: 0, False: 269] ------------------ 120| 269| !CBB_flush(out)) { ------------------ | Branch (120:7): [True: 0, False: 269] ------------------ 121| 0| OPENSSL_PUT_ERROR(EVP, EVP_R_ENCODE_ERROR); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 122| 0| return 0; 123| 0| } 124| | 125| 269| return 1; 126| 269|} p_dsa_asn1.c:int_dsa_free: 259| 463|static void int_dsa_free(EVP_PKEY *pkey) { 260| 463| DSA_free(pkey->pkey); 261| 463| pkey->pkey = NULL; 262| 463|} p_ec_asn1.c:eckey_pub_decode: 92| 752|static int eckey_pub_decode(EVP_PKEY *out, CBS *params, CBS *key) { 93| | // See RFC 5480, section 2. 94| | 95| | // The parameters are a named curve. 96| 752| EC_KEY *eckey = NULL; 97| 752| EC_GROUP *group = EC_KEY_parse_curve_name(params); 98| 752| if (group == NULL || CBS_len(params) != 0) { ------------------ | Branch (98:7): [True: 29, False: 723] | Branch (98:24): [True: 1, False: 722] ------------------ 99| 30| OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR); ------------------ | | 441| 30| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 100| 30| goto err; 101| 30| } 102| | 103| 722| eckey = EC_KEY_new(); 104| 722| if (eckey == NULL || // ------------------ | Branch (104:7): [True: 0, False: 722] ------------------ 105| 722| !EC_KEY_set_group(eckey, group) || ------------------ | Branch (105:7): [True: 0, False: 722] ------------------ 106| 722| !EC_KEY_oct2key(eckey, CBS_data(key), CBS_len(key), NULL)) { ------------------ | Branch (106:7): [True: 208, False: 514] ------------------ 107| 208| goto err; 108| 208| } 109| | 110| 514| EC_GROUP_free(group); 111| 514| EVP_PKEY_assign_EC_KEY(out, eckey); 112| 514| return 1; 113| | 114| 238|err: 115| 238| EC_GROUP_free(group); 116| 238| EC_KEY_free(eckey); 117| 238| return 0; 118| 722|} p_ec_asn1.c:eckey_pub_encode: 68| 514|static int eckey_pub_encode(CBB *out, const EVP_PKEY *key) { 69| 514| const EC_KEY *ec_key = key->pkey; 70| 514| const EC_GROUP *group = EC_KEY_get0_group(ec_key); 71| 514| const EC_POINT *public_key = EC_KEY_get0_public_key(ec_key); 72| | 73| | // See RFC 5480, section 2. 74| 514| CBB spki, algorithm, oid, key_bitstring; 75| 514| if (!CBB_add_asn1(out, &spki, CBS_ASN1_SEQUENCE) || ------------------ | | 222| 514|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED) | | ------------------ | | | | 196| 514|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT) | | | | ------------------ | | | | | | 193| 514|#define CBS_ASN1_TAG_SHIFT 24 | | | | ------------------ | | ------------------ ------------------ | Branch (75:7): [True: 0, False: 514] ------------------ 76| 514| !CBB_add_asn1(&spki, &algorithm, CBS_ASN1_SEQUENCE) || ------------------ | | 222| 514|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED) | | ------------------ | | | | 196| 514|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT) | | | | ------------------ | | | | | | 193| 514|#define CBS_ASN1_TAG_SHIFT 24 | | | | ------------------ | | ------------------ ------------------ | Branch (76:7): [True: 0, False: 514] ------------------ 77| 514| !CBB_add_asn1(&algorithm, &oid, CBS_ASN1_OBJECT) || ------------------ | | 219| 514|#define CBS_ASN1_OBJECT 0x6u ------------------ | Branch (77:7): [True: 0, False: 514] ------------------ 78| 514| !CBB_add_bytes(&oid, ec_asn1_meth.oid, ec_asn1_meth.oid_len) || ------------------ | Branch (78:7): [True: 0, False: 514] ------------------ 79| 514| !EC_KEY_marshal_curve_name(&algorithm, group) || ------------------ | Branch (79:7): [True: 0, False: 514] ------------------ 80| 514| !CBB_add_asn1(&spki, &key_bitstring, CBS_ASN1_BITSTRING) || ------------------ | | 216| 514|#define CBS_ASN1_BITSTRING 0x3u ------------------ | Branch (80:7): [True: 0, False: 514] ------------------ 81| 514| !CBB_add_u8(&key_bitstring, 0 /* padding */) || ------------------ | Branch (81:7): [True: 0, False: 514] ------------------ 82| 514| !EC_POINT_point2cbb(&key_bitstring, group, public_key, ------------------ | Branch (82:7): [True: 0, False: 514] ------------------ 83| 514| POINT_CONVERSION_UNCOMPRESSED, NULL) || 84| 514| !CBB_flush(out)) { ------------------ | Branch (84:7): [True: 0, False: 514] ------------------ 85| 0| OPENSSL_PUT_ERROR(EVP, EVP_R_ENCODE_ERROR); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 86| 0| return 0; 87| 0| } 88| | 89| 514| return 1; 90| 514|} p_ec_asn1.c:int_ec_free: 264| 752|static void int_ec_free(EVP_PKEY *pkey) { 265| 752| EC_KEY_free(pkey->pkey); 266| 752| pkey->pkey = NULL; 267| 752|} p_ed25519_asn1.c:ed25519_pub_decode: 114| 16|static int ed25519_pub_decode(EVP_PKEY *out, CBS *params, CBS *key) { 115| | // See RFC 8410, section 4. 116| | 117| | // The parameters must be omitted. Public keys have length 32. 118| 16| if (CBS_len(params) != 0) { ------------------ | Branch (118:7): [True: 5, False: 11] ------------------ 119| 5| OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR); ------------------ | | 441| 5| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 120| 5| return 0; 121| 5| } 122| | 123| 11| return ed25519_set_pub_raw(out, CBS_data(key), CBS_len(key)); 124| 16|} p_ed25519_asn1.c:ed25519_pub_encode: 126| 1|static int ed25519_pub_encode(CBB *out, const EVP_PKEY *pkey) { 127| 1| const ED25519_KEY *key = pkey->pkey; 128| | 129| | // See RFC 8410, section 4. 130| 1| CBB spki, algorithm, oid, key_bitstring; 131| 1| if (!CBB_add_asn1(out, &spki, CBS_ASN1_SEQUENCE) || ------------------ | | 222| 1|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED) | | ------------------ | | | | 196| 1|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT) | | | | ------------------ | | | | | | 193| 1|#define CBS_ASN1_TAG_SHIFT 24 | | | | ------------------ | | ------------------ ------------------ | Branch (131:7): [True: 0, False: 1] ------------------ 132| 1| !CBB_add_asn1(&spki, &algorithm, CBS_ASN1_SEQUENCE) || ------------------ | | 222| 1|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED) | | ------------------ | | | | 196| 1|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT) | | | | ------------------ | | | | | | 193| 1|#define CBS_ASN1_TAG_SHIFT 24 | | | | ------------------ | | ------------------ ------------------ | Branch (132:7): [True: 0, False: 1] ------------------ 133| 1| !CBB_add_asn1(&algorithm, &oid, CBS_ASN1_OBJECT) || ------------------ | | 219| 1|#define CBS_ASN1_OBJECT 0x6u ------------------ | Branch (133:7): [True: 0, False: 1] ------------------ 134| 1| !CBB_add_bytes(&oid, ed25519_asn1_meth.oid, ed25519_asn1_meth.oid_len) || ------------------ | Branch (134:7): [True: 0, False: 1] ------------------ 135| 1| !CBB_add_asn1(&spki, &key_bitstring, CBS_ASN1_BITSTRING) || ------------------ | | 216| 1|#define CBS_ASN1_BITSTRING 0x3u ------------------ | Branch (135:7): [True: 0, False: 1] ------------------ 136| 1| !CBB_add_u8(&key_bitstring, 0 /* padding */) || ------------------ | Branch (136:7): [True: 0, False: 1] ------------------ 137| 1| !CBB_add_bytes(&key_bitstring, key->key + ED25519_PUBLIC_KEY_OFFSET, ------------------ | | 278| 1|#define ED25519_PUBLIC_KEY_OFFSET 32 ------------------ | Branch (137:7): [True: 0, False: 1] ------------------ 138| 1| 32) || 139| 1| !CBB_flush(out)) { ------------------ | Branch (139:7): [True: 0, False: 1] ------------------ 140| 0| OPENSSL_PUT_ERROR(EVP, EVP_R_ENCODE_ERROR); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 141| 0| return 0; 142| 0| } 143| | 144| 1| return 1; 145| 1|} p_ed25519_asn1.c:ed25519_set_pub_raw: 53| 11|static int ed25519_set_pub_raw(EVP_PKEY *pkey, const uint8_t *in, size_t len) { 54| 11| if (len != 32) { ------------------ | Branch (54:7): [True: 10, False: 1] ------------------ 55| 10| OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR); ------------------ | | 441| 10| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 56| 10| return 0; 57| 10| } 58| | 59| 1| ED25519_KEY *key = OPENSSL_malloc(sizeof(ED25519_KEY)); 60| 1| if (key == NULL) { ------------------ | Branch (60:7): [True: 0, False: 1] ------------------ 61| 0| return 0; 62| 0| } 63| | 64| 1| OPENSSL_memcpy(key->key + ED25519_PUBLIC_KEY_OFFSET, in, 32); ------------------ | | 278| 1|#define ED25519_PUBLIC_KEY_OFFSET 32 ------------------ 65| 1| key->has_private = 0; 66| | 67| 1| ed25519_free(pkey); 68| 1| pkey->pkey = key; 69| 1| return 1; 70| 1|} p_ed25519_asn1.c:ed25519_free: 26| 17|static void ed25519_free(EVP_PKEY *pkey) { 27| 17| OPENSSL_free(pkey->pkey); 28| 17| pkey->pkey = NULL; 29| 17|} p_rsa_asn1.c:rsa_pub_decode: 89| 366|static int rsa_pub_decode(EVP_PKEY *out, CBS *params, CBS *key) { 90| | // See RFC 3279, section 2.3.1. 91| | 92| | // The parameters must be NULL. 93| 366| CBS null; 94| 366| if (!CBS_get_asn1(params, &null, CBS_ASN1_NULL) || ------------------ | | 218| 366|#define CBS_ASN1_NULL 0x5u ------------------ | Branch (94:7): [True: 2, False: 364] ------------------ 95| 366| CBS_len(&null) != 0 || ------------------ | Branch (95:7): [True: 8, False: 356] ------------------ 96| 366| CBS_len(params) != 0) { ------------------ | Branch (96:7): [True: 5, False: 351] ------------------ 97| 15| OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR); ------------------ | | 441| 15| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 98| 15| return 0; 99| 15| } 100| | 101| 351| RSA *rsa = RSA_parse_public_key(key); 102| 351| if (rsa == NULL || CBS_len(key) != 0) { ------------------ | Branch (102:7): [True: 319, False: 32] | Branch (102:22): [True: 9, False: 23] ------------------ 103| 328| OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR); ------------------ | | 441| 328| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 104| 328| RSA_free(rsa); 105| 328| return 0; 106| 328| } 107| | 108| 23| EVP_PKEY_assign_RSA(out, rsa); 109| 23| return 1; 110| 351|} p_rsa_asn1.c:rsa_pub_encode: 69| 23|static int rsa_pub_encode(CBB *out, const EVP_PKEY *key) { 70| | // See RFC 3279, section 2.3.1. 71| 23| const RSA *rsa = key->pkey; 72| 23| CBB spki, algorithm, oid, null, key_bitstring; 73| 23| if (!CBB_add_asn1(out, &spki, CBS_ASN1_SEQUENCE) || ------------------ | | 222| 23|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED) | | ------------------ | | | | 196| 23|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT) | | | | ------------------ | | | | | | 193| 23|#define CBS_ASN1_TAG_SHIFT 24 | | | | ------------------ | | ------------------ ------------------ | Branch (73:7): [True: 0, False: 23] ------------------ 74| 23| !CBB_add_asn1(&spki, &algorithm, CBS_ASN1_SEQUENCE) || ------------------ | | 222| 23|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED) | | ------------------ | | | | 196| 23|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT) | | | | ------------------ | | | | | | 193| 23|#define CBS_ASN1_TAG_SHIFT 24 | | | | ------------------ | | ------------------ ------------------ | Branch (74:7): [True: 0, False: 23] ------------------ 75| 23| !CBB_add_asn1(&algorithm, &oid, CBS_ASN1_OBJECT) || ------------------ | | 219| 23|#define CBS_ASN1_OBJECT 0x6u ------------------ | Branch (75:7): [True: 0, False: 23] ------------------ 76| 23| !CBB_add_bytes(&oid, rsa_asn1_meth.oid, rsa_asn1_meth.oid_len) || ------------------ | Branch (76:7): [True: 0, False: 23] ------------------ 77| 23| !CBB_add_asn1(&algorithm, &null, CBS_ASN1_NULL) || ------------------ | | 218| 23|#define CBS_ASN1_NULL 0x5u ------------------ | Branch (77:7): [True: 0, False: 23] ------------------ 78| 23| !CBB_add_asn1(&spki, &key_bitstring, CBS_ASN1_BITSTRING) || ------------------ | | 216| 23|#define CBS_ASN1_BITSTRING 0x3u ------------------ | Branch (78:7): [True: 0, False: 23] ------------------ 79| 23| !CBB_add_u8(&key_bitstring, 0 /* padding */) || ------------------ | Branch (79:7): [True: 0, False: 23] ------------------ 80| 23| !RSA_marshal_public_key(&key_bitstring, rsa) || ------------------ | Branch (80:7): [True: 0, False: 23] ------------------ 81| 23| !CBB_flush(out)) { ------------------ | Branch (81:7): [True: 0, False: 23] ------------------ 82| 0| OPENSSL_PUT_ERROR(EVP, EVP_R_ENCODE_ERROR); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 83| 0| return 0; 84| 0| } 85| | 86| 23| return 1; 87| 23|} p_rsa_asn1.c:int_rsa_free: 174| 366|static void int_rsa_free(EVP_PKEY *pkey) { 175| 366| RSA_free(pkey->pkey); 176| 366| pkey->pkey = NULL; 177| 366|} p_x25519_asn1.c:x25519_pub_decode: 128| 15|static int x25519_pub_decode(EVP_PKEY *out, CBS *params, CBS *key) { 129| | // See RFC 8410, section 4. 130| | 131| | // The parameters must be omitted. Public keys have length 32. 132| 15| if (CBS_len(params) != 0) { ------------------ | Branch (132:7): [True: 5, False: 10] ------------------ 133| 5| OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR); ------------------ | | 441| 5| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 134| 5| return 0; 135| 5| } 136| | 137| 10| return x25519_set_pub_raw(out, CBS_data(key), CBS_len(key)); 138| 15|} p_x25519_asn1.c:x25519_pub_encode: 140| 1|static int x25519_pub_encode(CBB *out, const EVP_PKEY *pkey) { 141| 1| const X25519_KEY *key = pkey->pkey; 142| | 143| | // See RFC 8410, section 4. 144| 1| CBB spki, algorithm, oid, key_bitstring; 145| 1| if (!CBB_add_asn1(out, &spki, CBS_ASN1_SEQUENCE) || ------------------ | | 222| 1|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED) | | ------------------ | | | | 196| 1|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT) | | | | ------------------ | | | | | | 193| 1|#define CBS_ASN1_TAG_SHIFT 24 | | | | ------------------ | | ------------------ ------------------ | Branch (145:7): [True: 0, False: 1] ------------------ 146| 1| !CBB_add_asn1(&spki, &algorithm, CBS_ASN1_SEQUENCE) || ------------------ | | 222| 1|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED) | | ------------------ | | | | 196| 1|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT) | | | | ------------------ | | | | | | 193| 1|#define CBS_ASN1_TAG_SHIFT 24 | | | | ------------------ | | ------------------ ------------------ | Branch (146:7): [True: 0, False: 1] ------------------ 147| 1| !CBB_add_asn1(&algorithm, &oid, CBS_ASN1_OBJECT) || ------------------ | | 219| 1|#define CBS_ASN1_OBJECT 0x6u ------------------ | Branch (147:7): [True: 0, False: 1] ------------------ 148| 1| !CBB_add_bytes(&oid, x25519_asn1_meth.oid, x25519_asn1_meth.oid_len) || ------------------ | Branch (148:7): [True: 0, False: 1] ------------------ 149| 1| !CBB_add_asn1(&spki, &key_bitstring, CBS_ASN1_BITSTRING) || ------------------ | | 216| 1|#define CBS_ASN1_BITSTRING 0x3u ------------------ | Branch (149:7): [True: 0, False: 1] ------------------ 150| 1| !CBB_add_u8(&key_bitstring, 0 /* padding */) || ------------------ | Branch (150:7): [True: 0, False: 1] ------------------ 151| 1| !CBB_add_bytes(&key_bitstring, key->pub, 32) || ------------------ | Branch (151:7): [True: 0, False: 1] ------------------ 152| 1| !CBB_flush(out)) { ------------------ | Branch (152:7): [True: 0, False: 1] ------------------ 153| 0| OPENSSL_PUT_ERROR(EVP, EVP_R_ENCODE_ERROR); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 154| 0| return 0; 155| 0| } 156| | 157| 1| return 1; 158| 1|} p_x25519_asn1.c:x25519_set_pub_raw: 51| 10|static int x25519_set_pub_raw(EVP_PKEY *pkey, const uint8_t *in, size_t len) { 52| 10| if (len != 32) { ------------------ | Branch (52:7): [True: 9, False: 1] ------------------ 53| 9| OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR); ------------------ | | 441| 9| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 54| 9| return 0; 55| 9| } 56| | 57| 1| X25519_KEY *key = OPENSSL_malloc(sizeof(X25519_KEY)); 58| 1| if (key == NULL) { ------------------ | Branch (58:7): [True: 0, False: 1] ------------------ 59| 0| return 0; 60| 0| } 61| | 62| 1| OPENSSL_memcpy(key->pub, in, 32); 63| 1| key->has_private = 0; 64| | 65| 1| x25519_free(pkey); 66| 1| pkey->pkey = key; 67| 1| return 1; 68| 1|} p_x25519_asn1.c:x25519_free: 26| 16|static void x25519_free(EVP_PKEY *pkey) { 27| 16| OPENSSL_free(pkey->pkey); 28| 16| pkey->pkey = NULL; 29| 16|} CRYPTO_new_ex_data: 206| 1.53k|void CRYPTO_new_ex_data(CRYPTO_EX_DATA *ad) { 207| 1.53k| ad->sk = NULL; 208| 1.53k|} CRYPTO_free_ex_data: 211| 1.53k| CRYPTO_EX_DATA *ad) { 212| 1.53k| if (ad->sk == NULL) { ------------------ | Branch (212:7): [True: 1.53k, False: 0] ------------------ 213| | // Nothing to do. 214| 1.53k| return; 215| 1.53k| } 216| | 217| 0| uint32_t num_funcs = CRYPTO_atomic_load_u32(&ex_data_class->num_funcs); 218| | // |CRYPTO_get_ex_new_index| will not allocate indices beyond |INT_MAX|. 219| 0| assert(num_funcs <= (size_t)(INT_MAX - ex_data_class->num_reserved)); 220| | 221| | // Defer dereferencing |ex_data_class->funcs| and |funcs->next|. It must come 222| | // after the |num_funcs| comparison to be correctly synchronized. 223| 0| CRYPTO_EX_DATA_FUNCS *const *funcs = &ex_data_class->funcs; 224| 0| for (uint32_t i = 0; i < num_funcs; i++) { ------------------ | Branch (224:24): [True: 0, False: 0] ------------------ 225| 0| if ((*funcs)->free_func != NULL) { ------------------ | Branch (225:9): [True: 0, False: 0] ------------------ 226| 0| int index = (int)i + ex_data_class->num_reserved; 227| 0| void *ptr = CRYPTO_get_ex_data(ad, index); 228| 0| (*funcs)->free_func(obj, ptr, ad, index, (*funcs)->argl, (*funcs)->argp); 229| 0| } 230| 0| funcs = &(*funcs)->next; 231| 0| } 232| | 233| 0| sk_void_free(ad->sk); 234| 0| ad->sk = NULL; 235| 0|} BN_add_word: 138| 123|int BN_add_word(BIGNUM *a, BN_ULONG w) { 139| 123| BN_ULONG l; 140| 123| int i; 141| | 142| | // degenerate case: w is zero 143| 123| if (!w) { ------------------ | Branch (143:7): [True: 0, False: 123] ------------------ 144| 0| return 1; 145| 0| } 146| | 147| | // degenerate case: a is zero 148| 123| if (BN_is_zero(a)) { ------------------ | Branch (148:7): [True: 0, False: 123] ------------------ 149| 0| return BN_set_word(a, w); 150| 0| } 151| | 152| | // handle 'a' when negative 153| 123| if (a->neg) { ------------------ | Branch (153:7): [True: 0, False: 123] ------------------ 154| 0| a->neg = 0; 155| 0| i = BN_sub_word(a, w); 156| 0| if (!BN_is_zero(a)) { ------------------ | Branch (156:9): [True: 0, False: 0] ------------------ 157| 0| a->neg = !(a->neg); 158| 0| } 159| 0| return i; 160| 0| } 161| | 162| 413| for (i = 0; w != 0 && i < a->width; i++) { ------------------ | Branch (162:15): [True: 290, False: 123] | Branch (162:25): [True: 290, False: 0] ------------------ 163| 290| a->d[i] = l = a->d[i] + w; 164| 290| w = (w > l) ? 1 : 0; ------------------ | Branch (164:9): [True: 167, False: 123] ------------------ 165| 290| } 166| | 167| 123| if (w && i == a->width) { ------------------ | Branch (167:7): [True: 0, False: 123] | Branch (167:12): [True: 0, False: 0] ------------------ 168| 0| if (!bn_wexpand(a, a->width + 1)) { ------------------ | Branch (168:9): [True: 0, False: 0] ------------------ 169| 0| return 0; 170| 0| } 171| 0| a->width++; 172| 0| a->d[i] = w; 173| 0| } 174| | 175| 123| return 1; 176| 123|} BN_sub: 178| 4|int BN_sub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b) { 179| 4| int add = 0, neg = 0; 180| 4| const BIGNUM *tmp; 181| | 182| | // a - b a-b 183| | // a - -b a+b 184| | // -a - b -(a+b) 185| | // -a - -b b-a 186| 4| if (a->neg) { ------------------ | Branch (186:7): [True: 0, False: 4] ------------------ 187| 0| if (b->neg) { ------------------ | Branch (187:9): [True: 0, False: 0] ------------------ 188| 0| tmp = a; 189| 0| a = b; 190| 0| b = tmp; 191| 0| } else { 192| 0| add = 1; 193| 0| neg = 1; 194| 0| } 195| 4| } else { 196| 4| if (b->neg) { ------------------ | Branch (196:9): [True: 0, False: 4] ------------------ 197| 0| add = 1; 198| 0| neg = 0; 199| 0| } 200| 4| } 201| | 202| 4| if (add) { ------------------ | Branch (202:7): [True: 0, False: 4] ------------------ 203| 0| if (!BN_uadd(r, a, b)) { ------------------ | Branch (203:9): [True: 0, False: 0] ------------------ 204| 0| return 0; 205| 0| } 206| | 207| 0| r->neg = neg; 208| 0| return 1; 209| 0| } 210| | 211| 4| if (BN_ucmp(a, b) < 0) { ------------------ | Branch (211:7): [True: 0, False: 4] ------------------ 212| 0| if (!BN_usub(r, b, a)) { ------------------ | Branch (212:9): [True: 0, False: 0] ------------------ 213| 0| return 0; 214| 0| } 215| 0| r->neg = 1; 216| 4| } else { 217| 4| if (!BN_usub(r, a, b)) { ------------------ | Branch (217:9): [True: 0, False: 4] ------------------ 218| 0| return 0; 219| 0| } 220| 4| r->neg = 0; 221| 4| } 222| | 223| 4| return 1; 224| 4|} bn_usub_consttime: 226| 317|int bn_usub_consttime(BIGNUM *r, const BIGNUM *a, const BIGNUM *b) { 227| | // |b| may have more words than |a| given non-minimal inputs, but all words 228| | // beyond |a->width| must then be zero. 229| 317| int b_width = b->width; 230| 317| if (b_width > a->width) { ------------------ | Branch (230:7): [True: 0, False: 317] ------------------ 231| 0| if (!bn_fits_in_words(b, a->width)) { ------------------ | Branch (231:9): [True: 0, False: 0] ------------------ 232| 0| OPENSSL_PUT_ERROR(BN, BN_R_ARG2_LT_ARG3); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 233| 0| return 0; 234| 0| } 235| 0| b_width = a->width; 236| 0| } 237| | 238| 317| if (!bn_wexpand(r, a->width)) { ------------------ | Branch (238:7): [True: 0, False: 317] ------------------ 239| 0| return 0; 240| 0| } 241| | 242| 317| BN_ULONG borrow = bn_sub_words(r->d, a->d, b->d, b_width); 243| 318| for (int i = b_width; i < a->width; i++) { ------------------ | Branch (243:25): [True: 1, False: 317] ------------------ 244| | // |r| and |a| may alias, so use a temporary. 245| 1| BN_ULONG tmp = a->d[i]; 246| 1| r->d[i] = a->d[i] - borrow; 247| 1| borrow = tmp < r->d[i]; 248| 1| } 249| | 250| 317| if (borrow) { ------------------ | Branch (250:7): [True: 0, False: 317] ------------------ 251| 0| OPENSSL_PUT_ERROR(BN, BN_R_ARG2_LT_ARG3); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 252| 0| return 0; 253| 0| } 254| | 255| 317| r->width = a->width; 256| 317| r->neg = 0; 257| 317| return 1; 258| 317|} BN_usub: 260| 317|int BN_usub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b) { 261| 317| if (!bn_usub_consttime(r, a, b)) { ------------------ | Branch (261:7): [True: 0, False: 317] ------------------ 262| 0| return 0; 263| 0| } 264| 317| bn_set_minimal_width(r); 265| 317| return 1; 266| 317|} bn_mul_add_words: 98| 131k| BN_ULONG w) { 99| 131k| BN_ULONG c1 = 0; 100| | 101| 131k| if (num == 0) { ------------------ | Branch (101:7): [True: 0, False: 131k] ------------------ 102| 0| return (c1); 103| 0| } 104| | 105| 262k| while (num & ~3) { ------------------ | Branch (105:10): [True: 131k, False: 131k] ------------------ 106| 131k| mul_add(rp[0], ap[0], w, c1); ------------------ | | 69| 131k| do { \ | | 70| 131k| register BN_ULONG high, low; \ | | 71| 131k| __asm__("mulq %3" : "=a"(low), "=d"(high) : "a"(word), "m"(a) : "cc"); \ | | 72| 131k| __asm__("addq %2,%0; adcq %3,%1" \ | | 73| 131k| : "+r"(carry), "+d"(high) \ | | 74| 131k| : "a"(low), "g"(0) \ | | 75| 131k| : "cc"); \ | | 76| 131k| __asm__("addq %2,%0; adcq %3,%1" \ | | 77| 131k| : "+m"(r), "+d"(high) \ | | 78| 131k| : "r"(carry), "g"(0) \ | | 79| 131k| : "cc"); \ | | 80| 131k| (carry) = high; \ | | 81| 131k| } while (0) | | ------------------ | | | Branch (81:12): [Folded - Ignored] | | ------------------ ------------------ 107| 131k| mul_add(rp[1], ap[1], w, c1); ------------------ | | 69| 131k| do { \ | | 70| 131k| register BN_ULONG high, low; \ | | 71| 131k| __asm__("mulq %3" : "=a"(low), "=d"(high) : "a"(word), "m"(a) : "cc"); \ | | 72| 131k| __asm__("addq %2,%0; adcq %3,%1" \ | | 73| 131k| : "+r"(carry), "+d"(high) \ | | 74| 131k| : "a"(low), "g"(0) \ | | 75| 131k| : "cc"); \ | | 76| 131k| __asm__("addq %2,%0; adcq %3,%1" \ | | 77| 131k| : "+m"(r), "+d"(high) \ | | 78| 131k| : "r"(carry), "g"(0) \ | | 79| 131k| : "cc"); \ | | 80| 131k| (carry) = high; \ | | 81| 131k| } while (0) | | ------------------ | | | Branch (81:12): [Folded - Ignored] | | ------------------ ------------------ 108| 131k| mul_add(rp[2], ap[2], w, c1); ------------------ | | 69| 131k| do { \ | | 70| 131k| register BN_ULONG high, low; \ | | 71| 131k| __asm__("mulq %3" : "=a"(low), "=d"(high) : "a"(word), "m"(a) : "cc"); \ | | 72| 131k| __asm__("addq %2,%0; adcq %3,%1" \ | | 73| 131k| : "+r"(carry), "+d"(high) \ | | 74| 131k| : "a"(low), "g"(0) \ | | 75| 131k| : "cc"); \ | | 76| 131k| __asm__("addq %2,%0; adcq %3,%1" \ | | 77| 131k| : "+m"(r), "+d"(high) \ | | 78| 131k| : "r"(carry), "g"(0) \ | | 79| 131k| : "cc"); \ | | 80| 131k| (carry) = high; \ | | 81| 131k| } while (0) | | ------------------ | | | Branch (81:12): [Folded - Ignored] | | ------------------ ------------------ 109| 131k| mul_add(rp[3], ap[3], w, c1); ------------------ | | 69| 131k| do { \ | | 70| 131k| register BN_ULONG high, low; \ | | 71| 131k| __asm__("mulq %3" : "=a"(low), "=d"(high) : "a"(word), "m"(a) : "cc"); \ | | 72| 131k| __asm__("addq %2,%0; adcq %3,%1" \ | | 73| 131k| : "+r"(carry), "+d"(high) \ | | 74| 131k| : "a"(low), "g"(0) \ | | 75| 131k| : "cc"); \ | | 76| 131k| __asm__("addq %2,%0; adcq %3,%1" \ | | 77| 131k| : "+m"(r), "+d"(high) \ | | 78| 131k| : "r"(carry), "g"(0) \ | | 79| 131k| : "cc"); \ | | 80| 131k| (carry) = high; \ | | 81| 131k| } while (0) | | ------------------ | | | Branch (81:12): [Folded - Ignored] | | ------------------ ------------------ 110| 131k| ap += 4; 111| 131k| rp += 4; 112| 131k| num -= 4; 113| 131k| } 114| 131k| if (num) { ------------------ | Branch (114:7): [True: 2.19k, False: 128k] ------------------ 115| 2.19k| mul_add(rp[0], ap[0], w, c1); ------------------ | | 69| 2.19k| do { \ | | 70| 2.19k| register BN_ULONG high, low; \ | | 71| 2.19k| __asm__("mulq %3" : "=a"(low), "=d"(high) : "a"(word), "m"(a) : "cc"); \ | | 72| 2.19k| __asm__("addq %2,%0; adcq %3,%1" \ | | 73| 2.19k| : "+r"(carry), "+d"(high) \ | | 74| 2.19k| : "a"(low), "g"(0) \ | | 75| 2.19k| : "cc"); \ | | 76| 2.19k| __asm__("addq %2,%0; adcq %3,%1" \ | | 77| 2.19k| : "+m"(r), "+d"(high) \ | | 78| 2.19k| : "r"(carry), "g"(0) \ | | 79| 2.19k| : "cc"); \ | | 80| 2.19k| (carry) = high; \ | | 81| 2.19k| } while (0) | | ------------------ | | | Branch (81:12): [Folded - Ignored] | | ------------------ ------------------ 116| 2.19k| if (--num == 0) { ------------------ | Branch (116:9): [True: 711, False: 1.48k] ------------------ 117| 711| return c1; 118| 711| } 119| 1.48k| mul_add(rp[1], ap[1], w, c1); ------------------ | | 69| 1.48k| do { \ | | 70| 1.48k| register BN_ULONG high, low; \ | | 71| 1.48k| __asm__("mulq %3" : "=a"(low), "=d"(high) : "a"(word), "m"(a) : "cc"); \ | | 72| 1.48k| __asm__("addq %2,%0; adcq %3,%1" \ | | 73| 1.48k| : "+r"(carry), "+d"(high) \ | | 74| 1.48k| : "a"(low), "g"(0) \ | | 75| 1.48k| : "cc"); \ | | 76| 1.48k| __asm__("addq %2,%0; adcq %3,%1" \ | | 77| 1.48k| : "+m"(r), "+d"(high) \ | | 78| 1.48k| : "r"(carry), "g"(0) \ | | 79| 1.48k| : "cc"); \ | | 80| 1.48k| (carry) = high; \ | | 81| 1.48k| } while (0) | | ------------------ | | | Branch (81:12): [Folded - Ignored] | | ------------------ ------------------ 120| 1.48k| if (--num == 0) { ------------------ | Branch (120:9): [True: 1.36k, False: 122] ------------------ 121| 1.36k| return c1; 122| 1.36k| } 123| 122| mul_add(rp[2], ap[2], w, c1); ------------------ | | 69| 122| do { \ | | 70| 122| register BN_ULONG high, low; \ | | 71| 122| __asm__("mulq %3" : "=a"(low), "=d"(high) : "a"(word), "m"(a) : "cc"); \ | | 72| 122| __asm__("addq %2,%0; adcq %3,%1" \ | | 73| 122| : "+r"(carry), "+d"(high) \ | | 74| 122| : "a"(low), "g"(0) \ | | 75| 122| : "cc"); \ | | 76| 122| __asm__("addq %2,%0; adcq %3,%1" \ | | 77| 122| : "+m"(r), "+d"(high) \ | | 78| 122| : "r"(carry), "g"(0) \ | | 79| 122| : "cc"); \ | | 80| 122| (carry) = high; \ | | 81| 122| } while (0) | | ------------------ | | | Branch (81:12): [Folded - Ignored] | | ------------------ ------------------ 124| 122| return c1; 125| 1.48k| } 126| | 127| 128k| return c1; 128| 131k|} bn_mul_words: 131| 5.18M| BN_ULONG w) { 132| 5.18M| BN_ULONG c1 = 0; 133| | 134| 5.18M| if (num == 0) { ------------------ | Branch (134:7): [True: 0, False: 5.18M] ------------------ 135| 0| return c1; 136| 0| } 137| | 138| 10.3M| while (num & ~3) { ------------------ | Branch (138:10): [True: 5.15M, False: 5.18M] ------------------ 139| 5.15M| mul(rp[0], ap[0], w, c1); ------------------ | | 84| 5.15M| do { \ | | 85| 5.15M| register BN_ULONG high, low; \ | | 86| 5.15M| __asm__("mulq %3" : "=a"(low), "=d"(high) : "a"(word), "g"(a) : "cc"); \ | | 87| 5.15M| __asm__("addq %2,%0; adcq %3,%1" \ | | 88| 5.15M| : "+r"(carry), "+d"(high) \ | | 89| 5.15M| : "a"(low), "g"(0) \ | | 90| 5.15M| : "cc"); \ | | 91| 5.15M| (r) = (carry); \ | | 92| 5.15M| (carry) = high; \ | | 93| 5.15M| } while (0) | | ------------------ | | | Branch (93:12): [Folded - Ignored] | | ------------------ ------------------ 140| 5.15M| mul(rp[1], ap[1], w, c1); ------------------ | | 84| 5.15M| do { \ | | 85| 5.15M| register BN_ULONG high, low; \ | | 86| 5.15M| __asm__("mulq %3" : "=a"(low), "=d"(high) : "a"(word), "g"(a) : "cc"); \ | | 87| 5.15M| __asm__("addq %2,%0; adcq %3,%1" \ | | 88| 5.15M| : "+r"(carry), "+d"(high) \ | | 89| 5.15M| : "a"(low), "g"(0) \ | | 90| 5.15M| : "cc"); \ | | 91| 5.15M| (r) = (carry); \ | | 92| 5.15M| (carry) = high; \ | | 93| 5.15M| } while (0) | | ------------------ | | | Branch (93:12): [Folded - Ignored] | | ------------------ ------------------ 141| 5.15M| mul(rp[2], ap[2], w, c1); ------------------ | | 84| 5.15M| do { \ | | 85| 5.15M| register BN_ULONG high, low; \ | | 86| 5.15M| __asm__("mulq %3" : "=a"(low), "=d"(high) : "a"(word), "g"(a) : "cc"); \ | | 87| 5.15M| __asm__("addq %2,%0; adcq %3,%1" \ | | 88| 5.15M| : "+r"(carry), "+d"(high) \ | | 89| 5.15M| : "a"(low), "g"(0) \ | | 90| 5.15M| : "cc"); \ | | 91| 5.15M| (r) = (carry); \ | | 92| 5.15M| (carry) = high; \ | | 93| 5.15M| } while (0) | | ------------------ | | | Branch (93:12): [Folded - Ignored] | | ------------------ ------------------ 142| 5.15M| mul(rp[3], ap[3], w, c1); ------------------ | | 84| 5.15M| do { \ | | 85| 5.15M| register BN_ULONG high, low; \ | | 86| 5.15M| __asm__("mulq %3" : "=a"(low), "=d"(high) : "a"(word), "g"(a) : "cc"); \ | | 87| 5.15M| __asm__("addq %2,%0; adcq %3,%1" \ | | 88| 5.15M| : "+r"(carry), "+d"(high) \ | | 89| 5.15M| : "a"(low), "g"(0) \ | | 90| 5.15M| : "cc"); \ | | 91| 5.15M| (r) = (carry); \ | | 92| 5.15M| (carry) = high; \ | | 93| 5.15M| } while (0) | | ------------------ | | | Branch (93:12): [Folded - Ignored] | | ------------------ ------------------ 143| 5.15M| ap += 4; 144| 5.15M| rp += 4; 145| 5.15M| num -= 4; 146| 5.15M| } 147| 5.18M| if (num) { ------------------ | Branch (147:7): [True: 37.5k, False: 5.14M] ------------------ 148| 37.5k| mul(rp[0], ap[0], w, c1); ------------------ | | 84| 37.5k| do { \ | | 85| 37.5k| register BN_ULONG high, low; \ | | 86| 37.5k| __asm__("mulq %3" : "=a"(low), "=d"(high) : "a"(word), "g"(a) : "cc"); \ | | 87| 37.5k| __asm__("addq %2,%0; adcq %3,%1" \ | | 88| 37.5k| : "+r"(carry), "+d"(high) \ | | 89| 37.5k| : "a"(low), "g"(0) \ | | 90| 37.5k| : "cc"); \ | | 91| 37.5k| (r) = (carry); \ | | 92| 37.5k| (carry) = high; \ | | 93| 37.5k| } while (0) | | ------------------ | | | Branch (93:12): [Folded - Ignored] | | ------------------ ------------------ 149| 37.5k| if (--num == 0) { ------------------ | Branch (149:9): [True: 36.7k, False: 793] ------------------ 150| 36.7k| return c1; 151| 36.7k| } 152| 793| mul(rp[1], ap[1], w, c1); ------------------ | | 84| 793| do { \ | | 85| 793| register BN_ULONG high, low; \ | | 86| 793| __asm__("mulq %3" : "=a"(low), "=d"(high) : "a"(word), "g"(a) : "cc"); \ | | 87| 793| __asm__("addq %2,%0; adcq %3,%1" \ | | 88| 793| : "+r"(carry), "+d"(high) \ | | 89| 793| : "a"(low), "g"(0) \ | | 90| 793| : "cc"); \ | | 91| 793| (r) = (carry); \ | | 92| 793| (carry) = high; \ | | 93| 793| } while (0) | | ------------------ | | | Branch (93:12): [Folded - Ignored] | | ------------------ ------------------ 153| 793| if (--num == 0) { ------------------ | Branch (153:9): [True: 44, False: 749] ------------------ 154| 44| return c1; 155| 44| } 156| 749| mul(rp[2], ap[2], w, c1); ------------------ | | 84| 749| do { \ | | 85| 749| register BN_ULONG high, low; \ | | 86| 749| __asm__("mulq %3" : "=a"(low), "=d"(high) : "a"(word), "g"(a) : "cc"); \ | | 87| 749| __asm__("addq %2,%0; adcq %3,%1" \ | | 88| 749| : "+r"(carry), "+d"(high) \ | | 89| 749| : "a"(low), "g"(0) \ | | 90| 749| : "cc"); \ | | 91| 749| (r) = (carry); \ | | 92| 749| (carry) = high; \ | | 93| 749| } while (0) | | ------------------ | | | Branch (93:12): [Folded - Ignored] | | ------------------ ------------------ 157| 749| } 158| 5.14M| return c1; 159| 5.18M|} bn_sqr_words: 161| 105|void bn_sqr_words(BN_ULONG *r, const BN_ULONG *a, size_t n) { 162| 105| if (n == 0) { ------------------ | Branch (162:7): [True: 0, False: 105] ------------------ 163| 0| return; 164| 0| } 165| | 166| 227| while (n & ~3) { ------------------ | Branch (166:10): [True: 122, False: 105] ------------------ 167| 122| sqr(r[0], r[1], a[0]); ------------------ | | 95| 122|#define sqr(r0, r1, a) __asm__("mulq %2" : "=a"(r0), "=d"(r1) : "a"(a) : "cc"); ------------------ 168| 122| sqr(r[2], r[3], a[1]); ------------------ | | 95| 122|#define sqr(r0, r1, a) __asm__("mulq %2" : "=a"(r0), "=d"(r1) : "a"(a) : "cc"); ------------------ 169| 122| sqr(r[4], r[5], a[2]); ------------------ | | 95| 122|#define sqr(r0, r1, a) __asm__("mulq %2" : "=a"(r0), "=d"(r1) : "a"(a) : "cc"); ------------------ 170| 122| sqr(r[6], r[7], a[3]); ------------------ | | 95| 122|#define sqr(r0, r1, a) __asm__("mulq %2" : "=a"(r0), "=d"(r1) : "a"(a) : "cc"); ------------------ 171| 122| a += 4; 172| 122| r += 8; 173| 122| n -= 4; 174| 122| } 175| 105| if (n) { ------------------ | Branch (175:7): [True: 105, False: 0] ------------------ 176| 105| sqr(r[0], r[1], a[0]); ------------------ | | 95| 105|#define sqr(r0, r1, a) __asm__("mulq %2" : "=a"(r0), "=d"(r1) : "a"(a) : "cc"); ------------------ 177| 105| if (--n == 0) { ------------------ | Branch (177:9): [True: 24, False: 81] ------------------ 178| 24| return; 179| 24| } 180| 81| sqr(r[2], r[3], a[1]); ------------------ | | 95| 81|#define sqr(r0, r1, a) __asm__("mulq %2" : "=a"(r0), "=d"(r1) : "a"(a) : "cc"); ------------------ 181| 81| if (--n == 0) { ------------------ | Branch (181:9): [True: 74, False: 7] ------------------ 182| 74| return; 183| 74| } 184| 7| sqr(r[4], r[5], a[2]); ------------------ | | 95| 7|#define sqr(r0, r1, a) __asm__("mulq %2" : "=a"(r0), "=d"(r1) : "a"(a) : "cc"); ------------------ 185| 7| } 186| 105|} bn_add_words: 189| 382k| size_t n) { 190| 382k| BN_ULONG ret; 191| 382k| size_t i = 0; 192| | 193| 382k| if (n == 0) { ------------------ | Branch (193:7): [True: 0, False: 382k] ------------------ 194| 0| return 0; 195| 0| } 196| | 197| 382k| __asm__ volatile ( 198| 382k| " subq %0,%0 \n" // clear carry 199| 382k| " jmp 1f \n" 200| 382k| ".p2align 4 \n" 201| 382k| "1:" 202| 382k| " movq (%4,%2,8),%0 \n" 203| 382k| " adcq (%5,%2,8),%0 \n" 204| 382k| " movq %0,(%3,%2,8) \n" 205| 382k| " lea 1(%2),%2 \n" 206| 382k| " dec %1 \n" 207| 382k| " jnz 1b \n" 208| 382k| " sbbq %0,%0 \n" 209| 382k| : "=&r"(ret), "+c"(n), "+r"(i) 210| 382k| : "r"(rp), "r"(ap), "r"(bp) 211| 382k| : "cc", "memory"); 212| | 213| 382k| return ret & 1; 214| 382k|} bn_sub_words: 217| 5.50M| size_t n) { 218| 5.50M| BN_ULONG ret; 219| 5.50M| size_t i = 0; 220| | 221| 5.50M| if (n == 0) { ------------------ | Branch (221:7): [True: 0, False: 5.50M] ------------------ 222| 0| return 0; 223| 0| } 224| | 225| 5.50M| __asm__ volatile ( 226| 5.50M| " subq %0,%0 \n" // clear borrow 227| 5.50M| " jmp 1f \n" 228| 5.50M| ".p2align 4 \n" 229| 5.50M| "1:" 230| 5.50M| " movq (%4,%2,8),%0 \n" 231| 5.50M| " sbbq (%5,%2,8),%0 \n" 232| 5.50M| " movq %0,(%3,%2,8) \n" 233| 5.50M| " lea 1(%2),%2 \n" 234| 5.50M| " dec %1 \n" 235| 5.50M| " jnz 1b \n" 236| 5.50M| " sbbq %0,%0 \n" 237| 5.50M| : "=&r"(ret), "+c"(n), "+r"(i) 238| 5.50M| : "r"(rp), "r"(ap), "r"(bp) 239| 5.50M| : "cc", "memory"); 240| | 241| 5.50M| return ret & 1; 242| 5.50M|} bn_sqr_comba4: 501| 981k|void bn_sqr_comba4(BN_ULONG r[8], const BN_ULONG a[4]) { 502| 981k| BN_ULONG c1, c2, c3; 503| | 504| 981k| c1 = 0; 505| 981k| c2 = 0; 506| 981k| c3 = 0; 507| 981k| sqr_add_c(a, 0, c1, c2, c3); ------------------ | | 262| 981k| do { \ | | 263| 981k| BN_ULONG t1, t2; \ | | 264| 981k| __asm__("mulq %2" : "=a"(t1), "=d"(t2) : "a"((a)[i]) : "cc"); \ | | 265| 981k| __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2" \ | | 266| 981k| : "+r"(c0), "+r"(c1), "+r"(c2) \ | | 267| 981k| : "r"(t1), "r"(t2), "g"(0) \ | | 268| 981k| : "cc"); \ | | 269| 981k| } while (0) | | ------------------ | | | Branch (269:12): [Folded - Ignored] | | ------------------ ------------------ 508| 981k| r[0] = c1; 509| 981k| c1 = 0; 510| 981k| sqr_add_c2(a, 1, 0, c2, c3, c1); ------------------ | | 285| 981k|#define sqr_add_c2(a, i, j, c0, c1, c2) mul_add_c2((a)[i], (a)[j], c0, c1, c2) | | ------------------ | | | | 272| 981k| do { \ | | | | 273| 981k| BN_ULONG t1, t2; \ | | | | 274| 981k| __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \ | | | | 275| 981k| __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2" \ | | | | 276| 981k| : "+r"(c0), "+r"(c1), "+r"(c2) \ | | | | 277| 981k| : "r"(t1), "r"(t2), "g"(0) \ | | | | 278| 981k| : "cc"); \ | | | | 279| 981k| __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2" \ | | | | 280| 981k| : "+r"(c0), "+r"(c1), "+r"(c2) \ | | | | 281| 981k| : "r"(t1), "r"(t2), "g"(0) \ | | | | 282| 981k| : "cc"); \ | | | | 283| 981k| } while (0) | | | | ------------------ | | | | | Branch (283:12): [Folded - Ignored] | | | | ------------------ | | ------------------ ------------------ 511| 981k| r[1] = c2; 512| 981k| c2 = 0; 513| 981k| sqr_add_c(a, 1, c3, c1, c2); ------------------ | | 262| 981k| do { \ | | 263| 981k| BN_ULONG t1, t2; \ | | 264| 981k| __asm__("mulq %2" : "=a"(t1), "=d"(t2) : "a"((a)[i]) : "cc"); \ | | 265| 981k| __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2" \ | | 266| 981k| : "+r"(c0), "+r"(c1), "+r"(c2) \ | | 267| 981k| : "r"(t1), "r"(t2), "g"(0) \ | | 268| 981k| : "cc"); \ | | 269| 981k| } while (0) | | ------------------ | | | Branch (269:12): [Folded - Ignored] | | ------------------ ------------------ 514| 981k| sqr_add_c2(a, 2, 0, c3, c1, c2); ------------------ | | 285| 981k|#define sqr_add_c2(a, i, j, c0, c1, c2) mul_add_c2((a)[i], (a)[j], c0, c1, c2) | | ------------------ | | | | 272| 981k| do { \ | | | | 273| 981k| BN_ULONG t1, t2; \ | | | | 274| 981k| __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \ | | | | 275| 981k| __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2" \ | | | | 276| 981k| : "+r"(c0), "+r"(c1), "+r"(c2) \ | | | | 277| 981k| : "r"(t1), "r"(t2), "g"(0) \ | | | | 278| 981k| : "cc"); \ | | | | 279| 981k| __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2" \ | | | | 280| 981k| : "+r"(c0), "+r"(c1), "+r"(c2) \ | | | | 281| 981k| : "r"(t1), "r"(t2), "g"(0) \ | | | | 282| 981k| : "cc"); \ | | | | 283| 981k| } while (0) | | | | ------------------ | | | | | Branch (283:12): [Folded - Ignored] | | | | ------------------ | | ------------------ ------------------ 515| 981k| r[2] = c3; 516| 981k| c3 = 0; 517| 981k| sqr_add_c2(a, 3, 0, c1, c2, c3); ------------------ | | 285| 981k|#define sqr_add_c2(a, i, j, c0, c1, c2) mul_add_c2((a)[i], (a)[j], c0, c1, c2) | | ------------------ | | | | 272| 981k| do { \ | | | | 273| 981k| BN_ULONG t1, t2; \ | | | | 274| 981k| __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \ | | | | 275| 981k| __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2" \ | | | | 276| 981k| : "+r"(c0), "+r"(c1), "+r"(c2) \ | | | | 277| 981k| : "r"(t1), "r"(t2), "g"(0) \ | | | | 278| 981k| : "cc"); \ | | | | 279| 981k| __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2" \ | | | | 280| 981k| : "+r"(c0), "+r"(c1), "+r"(c2) \ | | | | 281| 981k| : "r"(t1), "r"(t2), "g"(0) \ | | | | 282| 981k| : "cc"); \ | | | | 283| 981k| } while (0) | | | | ------------------ | | | | | Branch (283:12): [Folded - Ignored] | | | | ------------------ | | ------------------ ------------------ 518| 981k| sqr_add_c2(a, 2, 1, c1, c2, c3); ------------------ | | 285| 981k|#define sqr_add_c2(a, i, j, c0, c1, c2) mul_add_c2((a)[i], (a)[j], c0, c1, c2) | | ------------------ | | | | 272| 981k| do { \ | | | | 273| 981k| BN_ULONG t1, t2; \ | | | | 274| 981k| __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \ | | | | 275| 981k| __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2" \ | | | | 276| 981k| : "+r"(c0), "+r"(c1), "+r"(c2) \ | | | | 277| 981k| : "r"(t1), "r"(t2), "g"(0) \ | | | | 278| 981k| : "cc"); \ | | | | 279| 981k| __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2" \ | | | | 280| 981k| : "+r"(c0), "+r"(c1), "+r"(c2) \ | | | | 281| 981k| : "r"(t1), "r"(t2), "g"(0) \ | | | | 282| 981k| : "cc"); \ | | | | 283| 981k| } while (0) | | | | ------------------ | | | | | Branch (283:12): [Folded - Ignored] | | | | ------------------ | | ------------------ ------------------ 519| 981k| r[3] = c1; 520| 981k| c1 = 0; 521| 981k| sqr_add_c(a, 2, c2, c3, c1); ------------------ | | 262| 981k| do { \ | | 263| 981k| BN_ULONG t1, t2; \ | | 264| 981k| __asm__("mulq %2" : "=a"(t1), "=d"(t2) : "a"((a)[i]) : "cc"); \ | | 265| 981k| __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2" \ | | 266| 981k| : "+r"(c0), "+r"(c1), "+r"(c2) \ | | 267| 981k| : "r"(t1), "r"(t2), "g"(0) \ | | 268| 981k| : "cc"); \ | | 269| 981k| } while (0) | | ------------------ | | | Branch (269:12): [Folded - Ignored] | | ------------------ ------------------ 522| 981k| sqr_add_c2(a, 3, 1, c2, c3, c1); ------------------ | | 285| 981k|#define sqr_add_c2(a, i, j, c0, c1, c2) mul_add_c2((a)[i], (a)[j], c0, c1, c2) | | ------------------ | | | | 272| 981k| do { \ | | | | 273| 981k| BN_ULONG t1, t2; \ | | | | 274| 981k| __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \ | | | | 275| 981k| __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2" \ | | | | 276| 981k| : "+r"(c0), "+r"(c1), "+r"(c2) \ | | | | 277| 981k| : "r"(t1), "r"(t2), "g"(0) \ | | | | 278| 981k| : "cc"); \ | | | | 279| 981k| __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2" \ | | | | 280| 981k| : "+r"(c0), "+r"(c1), "+r"(c2) \ | | | | 281| 981k| : "r"(t1), "r"(t2), "g"(0) \ | | | | 282| 981k| : "cc"); \ | | | | 283| 981k| } while (0) | | | | ------------------ | | | | | Branch (283:12): [Folded - Ignored] | | | | ------------------ | | ------------------ ------------------ 523| 981k| r[4] = c2; 524| 981k| c2 = 0; 525| 981k| sqr_add_c2(a, 3, 2, c3, c1, c2); ------------------ | | 285| 981k|#define sqr_add_c2(a, i, j, c0, c1, c2) mul_add_c2((a)[i], (a)[j], c0, c1, c2) | | ------------------ | | | | 272| 981k| do { \ | | | | 273| 981k| BN_ULONG t1, t2; \ | | | | 274| 981k| __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \ | | | | 275| 981k| __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2" \ | | | | 276| 981k| : "+r"(c0), "+r"(c1), "+r"(c2) \ | | | | 277| 981k| : "r"(t1), "r"(t2), "g"(0) \ | | | | 278| 981k| : "cc"); \ | | | | 279| 981k| __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2" \ | | | | 280| 981k| : "+r"(c0), "+r"(c1), "+r"(c2) \ | | | | 281| 981k| : "r"(t1), "r"(t2), "g"(0) \ | | | | 282| 981k| : "cc"); \ | | | | 283| 981k| } while (0) | | | | ------------------ | | | | | Branch (283:12): [Folded - Ignored] | | | | ------------------ | | ------------------ ------------------ 526| 981k| r[5] = c3; 527| 981k| c3 = 0; 528| 981k| sqr_add_c(a, 3, c1, c2, c3); ------------------ | | 262| 981k| do { \ | | 263| 981k| BN_ULONG t1, t2; \ | | 264| 981k| __asm__("mulq %2" : "=a"(t1), "=d"(t2) : "a"((a)[i]) : "cc"); \ | | 265| 981k| __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2" \ | | 266| 981k| : "+r"(c0), "+r"(c1), "+r"(c2) \ | | 267| 981k| : "r"(t1), "r"(t2), "g"(0) \ | | 268| 981k| : "cc"); \ | | 269| 981k| } while (0) | | ------------------ | | | Branch (269:12): [Folded - Ignored] | | ------------------ ------------------ 529| 981k| r[6] = c1; 530| 981k| r[7] = c2; 531| 981k|} BN_new: 75| 17.9k|BIGNUM *BN_new(void) { 76| 17.9k| BIGNUM *bn = OPENSSL_malloc(sizeof(BIGNUM)); 77| | 78| 17.9k| if (bn == NULL) { ------------------ | Branch (78:7): [True: 0, False: 17.9k] ------------------ 79| 0| return NULL; 80| 0| } 81| | 82| 17.9k| OPENSSL_memset(bn, 0, sizeof(BIGNUM)); 83| 17.9k| bn->flags = BN_FLG_MALLOCED; ------------------ | | 1026| 17.9k|#define BN_FLG_MALLOCED 0x01 ------------------ 84| | 85| 17.9k| return bn; 86| 17.9k|} BN_init: 90| 2.47k|void BN_init(BIGNUM *bn) { 91| 2.47k| OPENSSL_memset(bn, 0, sizeof(BIGNUM)); 92| 2.47k|} BN_free: 94| 25.4k|void BN_free(BIGNUM *bn) { 95| 25.4k| if (bn == NULL) { ------------------ | Branch (95:7): [True: 5.01k, False: 20.3k] ------------------ 96| 5.01k| return; 97| 5.01k| } 98| | 99| 20.3k| if ((bn->flags & BN_FLG_STATIC_DATA) == 0) { ------------------ | | 1027| 20.3k|#define BN_FLG_STATIC_DATA 0x02 ------------------ | Branch (99:7): [True: 20.3k, False: 0] ------------------ 100| 20.3k| OPENSSL_free(bn->d); 101| 20.3k| } 102| | 103| 20.3k| if (bn->flags & BN_FLG_MALLOCED) { ------------------ | | 1026| 20.3k|#define BN_FLG_MALLOCED 0x01 ------------------ | Branch (103:7): [True: 17.9k, False: 2.45k] ------------------ 104| 17.9k| OPENSSL_free(bn); 105| 17.9k| } else { 106| 2.45k| bn->d = NULL; 107| 2.45k| } 108| 20.3k|} BN_clear_free: 110| 2.31k|void BN_clear_free(BIGNUM *bn) { 111| 2.31k| BN_free(bn); 112| 2.31k|} BN_copy: 134| 54.8k|BIGNUM *BN_copy(BIGNUM *dest, const BIGNUM *src) { 135| 54.8k| if (src == dest) { ------------------ | Branch (135:7): [True: 1.22k, False: 53.5k] ------------------ 136| 1.22k| return dest; 137| 1.22k| } 138| | 139| 53.5k| if (!bn_wexpand(dest, src->width)) { ------------------ | Branch (139:7): [True: 0, False: 53.5k] ------------------ 140| 0| return NULL; 141| 0| } 142| | 143| 53.5k| OPENSSL_memcpy(dest->d, src->d, sizeof(src->d[0]) * src->width); 144| | 145| 53.5k| dest->width = src->width; 146| 53.5k| dest->neg = src->neg; 147| 53.5k| return dest; 148| 53.5k|} BN_num_bits_word: 170| 1.04M|unsigned BN_num_bits_word(BN_ULONG l) { 171| | // |BN_num_bits| is often called on RSA prime factors. These have public bit 172| | // lengths, but all bits beyond the high bit are secret, so count bits in 173| | // constant time. 174| 1.04M| BN_ULONG x, mask; 175| 1.04M| int bits = (l != 0); 176| | 177| 1.04M|#if BN_BITS2 > 32 178| | // Look at the upper half of |x|. |x| is at most 64 bits long. 179| 1.04M| x = l >> 32; 180| | // Set |mask| to all ones if |x| (the top 32 bits of |l|) is non-zero and all 181| | // all zeros otherwise. 182| 1.04M| mask = 0u - x; 183| 1.04M| mask = (0u - (mask >> (BN_BITS2 - 1))); ------------------ | | 151| 1.04M|#define BN_BITS2 64 ------------------ 184| | // If |x| is non-zero, the lower half is included in the bit count in full, 185| | // and we count the upper half. Otherwise, we count the lower half. 186| 1.04M| bits += 32 & mask; 187| 1.04M| l ^= (x ^ l) & mask; // |l| is |x| if |mask| and remains |l| otherwise. 188| 1.04M|#endif 189| | 190| | // The remaining blocks are analogous iterations at lower powers of two. 191| 1.04M| x = l >> 16; 192| 1.04M| mask = 0u - x; 193| 1.04M| mask = (0u - (mask >> (BN_BITS2 - 1))); ------------------ | | 151| 1.04M|#define BN_BITS2 64 ------------------ 194| 1.04M| bits += 16 & mask; 195| 1.04M| l ^= (x ^ l) & mask; 196| | 197| 1.04M| x = l >> 8; 198| 1.04M| mask = 0u - x; 199| 1.04M| mask = (0u - (mask >> (BN_BITS2 - 1))); ------------------ | | 151| 1.04M|#define BN_BITS2 64 ------------------ 200| 1.04M| bits += 8 & mask; 201| 1.04M| l ^= (x ^ l) & mask; 202| | 203| 1.04M| x = l >> 4; 204| 1.04M| mask = 0u - x; 205| 1.04M| mask = (0u - (mask >> (BN_BITS2 - 1))); ------------------ | | 151| 1.04M|#define BN_BITS2 64 ------------------ 206| 1.04M| bits += 4 & mask; 207| 1.04M| l ^= (x ^ l) & mask; 208| | 209| 1.04M| x = l >> 2; 210| 1.04M| mask = 0u - x; 211| 1.04M| mask = (0u - (mask >> (BN_BITS2 - 1))); ------------------ | | 151| 1.04M|#define BN_BITS2 64 ------------------ 212| 1.04M| bits += 2 & mask; 213| 1.04M| l ^= (x ^ l) & mask; 214| | 215| 1.04M| x = l >> 1; 216| 1.04M| mask = 0u - x; 217| 1.04M| mask = (0u - (mask >> (BN_BITS2 - 1))); ------------------ | | 151| 1.04M|#define BN_BITS2 64 ------------------ 218| 1.04M| bits += 1 & mask; 219| | 220| 1.04M| return bits; 221| 1.04M|} BN_num_bits: 223| 1.04M|unsigned BN_num_bits(const BIGNUM *bn) { 224| 1.04M| const int width = bn_minimal_width(bn); 225| 1.04M| if (width == 0) { ------------------ | Branch (225:7): [True: 6, False: 1.04M] ------------------ 226| 6| return 0; 227| 6| } 228| | 229| 1.04M| return (width - 1) * BN_BITS2 + BN_num_bits_word(bn->d[width - 1]); ------------------ | | 151| 1.04M|#define BN_BITS2 64 ------------------ 230| 1.04M|} BN_num_bytes: 232| 7.59k|unsigned BN_num_bytes(const BIGNUM *bn) { 233| 7.59k| return (BN_num_bits(bn) + 7) / 8; 234| 7.59k|} BN_zero: 236| 6.50M|void BN_zero(BIGNUM *bn) { 237| 6.50M| bn->width = bn->neg = 0; 238| 6.50M|} BN_set_word: 244| 5.52k|int BN_set_word(BIGNUM *bn, BN_ULONG value) { 245| 5.52k| if (value == 0) { ------------------ | Branch (245:7): [True: 0, False: 5.52k] ------------------ 246| 0| BN_zero(bn); 247| 0| return 1; 248| 0| } 249| | 250| 5.52k| if (!bn_wexpand(bn, 1)) { ------------------ | Branch (250:7): [True: 0, False: 5.52k] ------------------ 251| 0| return 0; 252| 0| } 253| | 254| 5.52k| bn->neg = 0; 255| 5.52k| bn->d[0] = value; 256| 5.52k| bn->width = 1; 257| 5.52k| return 1; 258| 5.52k|} bn_fits_in_words: 306| 2.80M|int bn_fits_in_words(const BIGNUM *bn, size_t num) { 307| | // All words beyond |num| must be zero. 308| 2.80M| BN_ULONG mask = 0; 309| 10.9M| for (size_t i = num; i < (size_t)bn->width; i++) { ------------------ | Branch (309:24): [True: 8.17M, False: 2.80M] ------------------ 310| 8.17M| mask |= bn->d[i]; 311| 8.17M| } 312| 2.80M| return mask == 0; 313| 2.80M|} bn_copy_words: 315| 4|int bn_copy_words(BN_ULONG *out, size_t num, const BIGNUM *bn) { 316| 4| if (bn->neg) { ------------------ | Branch (316:7): [True: 0, False: 4] ------------------ 317| 0| OPENSSL_PUT_ERROR(BN, BN_R_NEGATIVE_NUMBER); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 318| 0| return 0; 319| 0| } 320| | 321| 4| size_t width = (size_t)bn->width; 322| 4| if (width > num) { ------------------ | Branch (322:7): [True: 0, False: 4] ------------------ 323| 0| if (!bn_fits_in_words(bn, num)) { ------------------ | Branch (323:9): [True: 0, False: 0] ------------------ 324| 0| OPENSSL_PUT_ERROR(BN, BN_R_BIGNUM_TOO_LONG); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 325| 0| return 0; 326| 0| } 327| 0| width = num; 328| 0| } 329| | 330| 4| OPENSSL_memset(out, 0, sizeof(BN_ULONG) * num); 331| 4| OPENSSL_memcpy(out, bn->d, sizeof(BN_ULONG) * width); 332| 4| return 1; 333| 4|} BN_is_negative: 335| 12.0k|int BN_is_negative(const BIGNUM *bn) { 336| 12.0k| return bn->neg != 0; 337| 12.0k|} BN_set_negative: 339| 4|void BN_set_negative(BIGNUM *bn, int sign) { 340| 4| if (sign && !BN_is_zero(bn)) { ------------------ | Branch (340:7): [True: 0, False: 4] | Branch (340:15): [True: 0, False: 0] ------------------ 341| 0| bn->neg = 1; 342| 4| } else { 343| 4| bn->neg = 0; 344| 4| } 345| 4|} bn_wexpand: 347| 8.23M|int bn_wexpand(BIGNUM *bn, size_t words) { 348| 8.23M| BN_ULONG *a; 349| | 350| 8.23M| if (words <= (size_t)bn->dmax) { ------------------ | Branch (350:7): [True: 8.20M, False: 31.2k] ------------------ 351| 8.20M| return 1; 352| 8.20M| } 353| | 354| 31.2k| if (words > BN_MAX_WORDS) { ------------------ | | 73| 31.2k|#define BN_MAX_WORDS (INT_MAX / (4 * BN_BITS2)) | | ------------------ | | | | 151| 31.2k|#define BN_BITS2 64 | | ------------------ ------------------ | Branch (354:7): [True: 0, False: 31.2k] ------------------ 355| 0| OPENSSL_PUT_ERROR(BN, BN_R_BIGNUM_TOO_LONG); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 356| 0| return 0; 357| 0| } 358| | 359| 31.2k| if (bn->flags & BN_FLG_STATIC_DATA) { ------------------ | | 1027| 31.2k|#define BN_FLG_STATIC_DATA 0x02 ------------------ | Branch (359:7): [True: 0, False: 31.2k] ------------------ 360| 0| OPENSSL_PUT_ERROR(BN, BN_R_EXPAND_ON_STATIC_BIGNUM_DATA); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 361| 0| return 0; 362| 0| } 363| | 364| 31.2k| a = OPENSSL_malloc(sizeof(BN_ULONG) * words); 365| 31.2k| if (a == NULL) { ------------------ | Branch (365:7): [True: 0, False: 31.2k] ------------------ 366| 0| return 0; 367| 0| } 368| | 369| 31.2k| OPENSSL_memcpy(a, bn->d, sizeof(BN_ULONG) * bn->width); 370| | 371| 31.2k| OPENSSL_free(bn->d); 372| 31.2k| bn->d = a; 373| 31.2k| bn->dmax = (int)words; 374| | 375| 31.2k| return 1; 376| 31.2k|} bn_resize_words: 386| 3.07k|int bn_resize_words(BIGNUM *bn, size_t words) { 387| 3.07k| if ((size_t)bn->width <= words) { ------------------ | Branch (387:7): [True: 3.07k, False: 0] ------------------ 388| 3.07k| if (!bn_wexpand(bn, words)) { ------------------ | Branch (388:9): [True: 0, False: 3.07k] ------------------ 389| 0| return 0; 390| 0| } 391| 3.07k| OPENSSL_memset(bn->d + bn->width, 0, 392| 3.07k| (words - bn->width) * sizeof(BN_ULONG)); 393| 3.07k| bn->width = (int)words; 394| 3.07k| return 1; 395| 3.07k| } 396| | 397| | // All words beyond the new width must be zero. 398| 0| if (!bn_fits_in_words(bn, words)) { ------------------ | Branch (398:7): [True: 0, False: 0] ------------------ 399| 0| OPENSSL_PUT_ERROR(BN, BN_R_BIGNUM_TOO_LONG); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 400| 0| return 0; 401| 0| } 402| 0| bn->width = (int)words; 403| 0| return 1; 404| 0|} bn_select_words: 407| 364k| const BN_ULONG *b, size_t num) { 408| 1.89M| for (size_t i = 0; i < num; i++) { ------------------ | Branch (408:22): [True: 1.52M, False: 364k] ------------------ 409| 1.52M| static_assert(sizeof(BN_ULONG) <= sizeof(crypto_word_t), 410| 1.52M| "crypto_word_t is too small"); 411| 1.52M| r[i] = constant_time_select_w(mask, a[i], b[i]); 412| 1.52M| } 413| 364k|} bn_minimal_width: 415| 11.3M|int bn_minimal_width(const BIGNUM *bn) { 416| 11.3M| int ret = bn->width; 417| 20.6M| while (ret > 0 && bn->d[ret - 1] == 0) { ------------------ | Branch (417:10): [True: 20.6M, False: 11.9k] | Branch (417:21): [True: 9.33M, False: 11.3M] ------------------ 418| 9.33M| ret--; 419| 9.33M| } 420| 11.3M| return ret; 421| 11.3M|} bn_set_minimal_width: 423| 8.25M|void bn_set_minimal_width(BIGNUM *bn) { 424| 8.25M| bn->width = bn_minimal_width(bn); 425| 8.25M| if (bn->width == 0) { ------------------ | Branch (425:7): [True: 11.9k, False: 8.24M] ------------------ 426| 11.9k| bn->neg = 0; 427| 11.9k| } 428| 8.25M|} bcm.c:BN_value_one_do_init: 159| 1|DEFINE_METHOD_FUNCTION(BIGNUM, BN_value_one) { 160| 1| static const BN_ULONG kOneLimbs[1] = { 1 }; 161| 1| out->d = (BN_ULONG*) kOneLimbs; 162| 1| out->width = 1; 163| 1| out->dmax = 1; 164| 1| out->neg = 0; 165| 1| out->flags = BN_FLG_STATIC_DATA; ------------------ | | 1027| 1|#define BN_FLG_STATIC_DATA 0x02 ------------------ 166| 1|} bn_big_endian_to_words: 65| 4.55k| size_t in_len) { 66| 19.7k| for (size_t i = 0; i < out_len; i++) { ------------------ | Branch (66:22): [True: 19.1k, False: 610] ------------------ 67| 19.1k| if (in_len < sizeof(BN_ULONG)) { ------------------ | Branch (67:9): [True: 3.94k, False: 15.1k] ------------------ 68| | // Load the last partial word. 69| 3.94k| BN_ULONG word = 0; 70| 17.6k| for (size_t j = 0; j < in_len; j++) { ------------------ | Branch (70:26): [True: 13.6k, False: 3.94k] ------------------ 71| 13.6k| word = (word << 8) | in[j]; 72| 13.6k| } 73| 3.94k| in_len = 0; 74| 3.94k| out[i] = word; 75| | // Fill the remainder with zeros. 76| 3.94k| OPENSSL_memset(out + i + 1, 0, (out_len - i - 1) * sizeof(BN_ULONG)); 77| 3.94k| break; 78| 3.94k| } 79| | 80| 15.1k| in_len -= sizeof(BN_ULONG); 81| 15.1k| out[i] = CRYPTO_load_word_be(in + in_len); 82| 15.1k| } 83| | 84| | // The caller should have sized the output to avoid truncation. 85| 4.55k| assert(in_len == 0); 86| 4.55k|} BN_bin2bn: 88| 3.49k|BIGNUM *BN_bin2bn(const uint8_t *in, size_t len, BIGNUM *ret) { 89| 3.49k| BIGNUM *bn = NULL; 90| 3.49k| if (ret == NULL) { ------------------ | Branch (90:7): [True: 16, False: 3.47k] ------------------ 91| 16| bn = BN_new(); 92| 16| if (bn == NULL) { ------------------ | Branch (92:9): [True: 0, False: 16] ------------------ 93| 0| return NULL; 94| 0| } 95| 16| ret = bn; 96| 16| } 97| | 98| 3.49k| if (len == 0) { ------------------ | Branch (98:7): [True: 0, False: 3.49k] ------------------ 99| 0| ret->width = 0; 100| 0| return ret; 101| 0| } 102| | 103| 3.49k| size_t num_words = ((len - 1) / BN_BYTES) + 1; ------------------ | | 152| 3.49k|#define BN_BYTES 8 ------------------ 104| 3.49k| if (!bn_wexpand(ret, num_words)) { ------------------ | Branch (104:7): [True: 0, False: 3.49k] ------------------ 105| 0| BN_free(bn); 106| 0| return NULL; 107| 0| } 108| | 109| | // |bn_wexpand| must check bounds on |num_words| to write it into 110| | // |ret->dmax|. 111| 3.49k| assert(num_words <= INT_MAX); 112| 3.49k| ret->width = (int)num_words; 113| 3.49k| ret->neg = 0; 114| | 115| 3.49k| bn_big_endian_to_words(ret->d, ret->width, in, len); 116| 3.49k| return ret; 117| 3.49k|} bn_words_to_big_endian: 178| 3.76k| size_t in_len) { 179| | // The caller should have selected an output length without truncation. 180| 3.76k| assert(fits_in_bytes(in, in_len, out_len)); 181| | 182| | // We only support little-endian platforms, so the internal representation is 183| | // also little-endian as bytes. We can simply copy it in reverse. 184| 3.76k| const uint8_t *bytes = (const uint8_t *)in; 185| 3.76k| size_t num_bytes = in_len * sizeof(BN_ULONG); 186| 3.76k| if (out_len < num_bytes) { ------------------ | Branch (186:7): [True: 3.11k, False: 650] ------------------ 187| 3.11k| num_bytes = out_len; 188| 3.11k| } 189| | 190| 119k| for (size_t i = 0; i < num_bytes; i++) { ------------------ | Branch (190:22): [True: 115k, False: 3.76k] ------------------ 191| 115k| out[out_len - i - 1] = bytes[i]; 192| 115k| } 193| | // Pad out the rest of the buffer with zeroes. 194| 3.76k| OPENSSL_memset(out, 0, out_len - num_bytes); 195| 3.76k|} BN_bn2bin_padded: 222| 1.39k|int BN_bn2bin_padded(uint8_t *out, size_t len, const BIGNUM *in) { 223| 1.39k| if (!fits_in_bytes(in->d, in->width, len)) { ------------------ | Branch (223:7): [True: 0, False: 1.39k] ------------------ 224| 0| return 0; 225| 0| } 226| | 227| 1.39k| bn_words_to_big_endian(out, len, in->d, in->width); 228| 1.39k| return 1; 229| 1.39k|} bcm.c:fits_in_bytes: 155| 5.15k| size_t num_bytes) { 156| 5.15k| const uint8_t *bytes = (const uint8_t *)words; 157| 5.15k| size_t tot_bytes = num_words * sizeof(BN_ULONG); 158| 5.15k| uint8_t mask = 0; 159| 23.2k| for (size_t i = num_bytes; i < tot_bytes; i++) { ------------------ | Branch (159:30): [True: 18.0k, False: 5.15k] ------------------ 160| 18.0k| mask |= bytes[i]; 161| 18.0k| } 162| 5.15k| return mask == 0; 163| 5.15k|} BN_ucmp: 99| 4.42k|int BN_ucmp(const BIGNUM *a, const BIGNUM *b) { 100| 4.42k| return bn_cmp_words_consttime(a->d, a->width, b->d, b->width); 101| 4.42k|} BN_cmp: 103| 2.48k|int BN_cmp(const BIGNUM *a, const BIGNUM *b) { 104| 2.48k| if ((a == NULL) || (b == NULL)) { ------------------ | Branch (104:7): [True: 0, False: 2.48k] | Branch (104:22): [True: 0, False: 2.48k] ------------------ 105| 0| if (a != NULL) { ------------------ | Branch (105:9): [True: 0, False: 0] ------------------ 106| 0| return -1; 107| 0| } else if (b != NULL) { ------------------ | Branch (107:16): [True: 0, False: 0] ------------------ 108| 0| return 1; 109| 0| } else { 110| 0| return 0; 111| 0| } 112| 0| } 113| | 114| | // We do not attempt to process the sign bit in constant time. Negative 115| | // |BIGNUM|s should never occur in crypto, only calculators. 116| 2.48k| if (a->neg != b->neg) { ------------------ | Branch (116:7): [True: 0, False: 2.48k] ------------------ 117| 0| if (a->neg) { ------------------ | Branch (117:9): [True: 0, False: 0] ------------------ 118| 0| return -1; 119| 0| } 120| 0| return 1; 121| 0| } 122| | 123| 2.48k| int ret = BN_ucmp(a, b); 124| 2.48k| return a->neg ? -ret : ret; ------------------ | Branch (124:10): [True: 0, False: 2.48k] ------------------ 125| 2.48k|} bn_less_than_words: 127| 1.05k|int bn_less_than_words(const BN_ULONG *a, const BN_ULONG *b, size_t len) { 128| 1.05k| return bn_cmp_words_consttime(a, len, b, len) < 0; 129| 1.05k|} BN_abs_is_word: 131| 969k|int BN_abs_is_word(const BIGNUM *bn, BN_ULONG w) { 132| 969k| if (bn->width == 0) { ------------------ | Branch (132:7): [True: 0, False: 969k] ------------------ 133| 0| return w == 0; 134| 0| } 135| 969k| BN_ULONG mask = bn->d[0] ^ w; 136| 3.80M| for (int i = 1; i < bn->width; i++) { ------------------ | Branch (136:19): [True: 2.83M, False: 969k] ------------------ 137| 2.83M| mask |= bn->d[i]; 138| 2.83M| } 139| 969k| return mask == 0; 140| 969k|} BN_is_zero: 153| 2.08M|int BN_is_zero(const BIGNUM *bn) { 154| 2.08M| return bn_fits_in_words(bn, 0); 155| 2.08M|} BN_is_one: 157| 968k|int BN_is_one(const BIGNUM *bn) { 158| 968k| return bn->neg == 0 && BN_abs_is_word(bn, 1); ------------------ | Branch (158:10): [True: 968k, False: 0] | Branch (158:26): [True: 25.2k, False: 943k] ------------------ 159| 968k|} BN_is_odd: 165| 12.8k|int BN_is_odd(const BIGNUM *bn) { 166| 12.8k| return bn->width > 0 && (bn->d[0] & 1) == 1; ------------------ | Branch (166:10): [True: 12.8k, False: 0] | Branch (166:27): [True: 12.2k, False: 584] ------------------ 167| 12.8k|} bcm.c:bn_cmp_words_consttime: 68| 5.48k| const BN_ULONG *b, size_t b_len) { 69| 5.48k| static_assert(sizeof(BN_ULONG) <= sizeof(crypto_word_t), 70| 5.48k| "crypto_word_t is too small"); 71| 5.48k| int ret = 0; 72| | // Process the common words in little-endian order. 73| 5.48k| size_t min = a_len < b_len ? a_len : b_len; ------------------ | Branch (73:16): [True: 611, False: 4.87k] ------------------ 74| 26.1k| for (size_t i = 0; i < min; i++) { ------------------ | Branch (74:22): [True: 20.6k, False: 5.48k] ------------------ 75| 20.6k| crypto_word_t eq = constant_time_eq_w(a[i], b[i]); 76| 20.6k| crypto_word_t lt = constant_time_lt_w(a[i], b[i]); 77| 20.6k| ret = 78| 20.6k| constant_time_select_int(eq, ret, constant_time_select_int(lt, -1, 1)); 79| 20.6k| } 80| | 81| | // If |a| or |b| has non-zero words beyond |min|, they take precedence. 82| 5.48k| if (a_len < b_len) { ------------------ | Branch (82:7): [True: 611, False: 4.87k] ------------------ 83| 611| crypto_word_t mask = 0; 84| 3.67k| for (size_t i = a_len; i < b_len; i++) { ------------------ | Branch (84:28): [True: 3.06k, False: 611] ------------------ 85| 3.06k| mask |= b[i]; 86| 3.06k| } 87| 611| ret = constant_time_select_int(constant_time_is_zero_w(mask), ret, -1); 88| 4.87k| } else if (b_len < a_len) { ------------------ | Branch (88:14): [True: 113, False: 4.75k] ------------------ 89| 113| crypto_word_t mask = 0; 90| 654| for (size_t i = b_len; i < a_len; i++) { ------------------ | Branch (90:28): [True: 541, False: 113] ------------------ 91| 541| mask |= a[i]; 92| 541| } 93| 113| ret = constant_time_select_int(constant_time_is_zero_w(mask), ret, 1); 94| 113| } 95| | 96| 5.48k| return ret; 97| 5.48k|} BN_CTX_new: 108| 682|BN_CTX *BN_CTX_new(void) { 109| 682| BN_CTX *ret = OPENSSL_malloc(sizeof(BN_CTX)); 110| 682| if (!ret) { ------------------ | Branch (110:7): [True: 0, False: 682] ------------------ 111| 0| return NULL; 112| 0| } 113| | 114| | // Initialise the structure 115| 682| ret->bignums = NULL; 116| 682| BN_STACK_init(&ret->stack); 117| 682| ret->used = 0; 118| 682| ret->error = 0; 119| 682| ret->defer_error = 0; 120| 682| return ret; 121| 682|} BN_CTX_free: 123| 1.35k|void BN_CTX_free(BN_CTX *ctx) { 124| 1.35k| if (ctx == NULL) { ------------------ | Branch (124:7): [True: 674, False: 682] ------------------ 125| 674| return; 126| 674| } 127| | 128| | // All |BN_CTX_start| calls must be matched with |BN_CTX_end|, otherwise the 129| | // function may use more memory than expected, potentially without bound if 130| | // done in a loop. Assert that all |BIGNUM|s have been released. 131| 682| assert(ctx->used == 0 || ctx->error); 132| 682| sk_BIGNUM_pop_free(ctx->bignums, BN_free); 133| 682| BN_STACK_cleanup(&ctx->stack); 134| 682| OPENSSL_free(ctx); 135| 682|} BN_CTX_start: 137| 3.40M|void BN_CTX_start(BN_CTX *ctx) { 138| 3.40M| if (ctx->error) { ------------------ | Branch (138:7): [True: 0, False: 3.40M] ------------------ 139| | // Once an operation has failed, |ctx->stack| no longer matches the number 140| | // of |BN_CTX_end| calls to come. Do nothing. 141| 0| return; 142| 0| } 143| | 144| 3.40M| if (!BN_STACK_push(&ctx->stack, ctx->used)) { ------------------ | Branch (144:7): [True: 0, False: 3.40M] ------------------ 145| 0| ctx->error = 1; 146| | // |BN_CTX_start| cannot fail, so defer the error to |BN_CTX_get|. 147| 0| ctx->defer_error = 1; 148| 0| } 149| 3.40M|} BN_CTX_get: 151| 6.50M|BIGNUM *BN_CTX_get(BN_CTX *ctx) { 152| | // Once any operation has failed, they all do. 153| 6.50M| if (ctx->error) { ------------------ | Branch (153:7): [True: 0, False: 6.50M] ------------------ 154| 0| if (ctx->defer_error) { ------------------ | Branch (154:9): [True: 0, False: 0] ------------------ 155| 0| OPENSSL_PUT_ERROR(BN, BN_R_TOO_MANY_TEMPORARY_VARIABLES); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 156| 0| ctx->defer_error = 0; 157| 0| } 158| 0| return NULL; 159| 0| } 160| | 161| 6.50M| if (ctx->bignums == NULL) { ------------------ | Branch (161:7): [True: 682, False: 6.50M] ------------------ 162| 682| ctx->bignums = sk_BIGNUM_new_null(); 163| 682| if (ctx->bignums == NULL) { ------------------ | Branch (163:9): [True: 0, False: 682] ------------------ 164| 0| ctx->error = 1; 165| 0| return NULL; 166| 0| } 167| 682| } 168| | 169| 6.50M| if (ctx->used == sk_BIGNUM_num(ctx->bignums)) { ------------------ | Branch (169:7): [True: 16.4k, False: 6.48M] ------------------ 170| 16.4k| BIGNUM *bn = BN_new(); 171| 16.4k| if (bn == NULL || !sk_BIGNUM_push(ctx->bignums, bn)) { ------------------ | Branch (171:9): [True: 0, False: 16.4k] | Branch (171:23): [True: 0, False: 16.4k] ------------------ 172| 0| OPENSSL_PUT_ERROR(BN, BN_R_TOO_MANY_TEMPORARY_VARIABLES); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 173| 0| BN_free(bn); 174| 0| ctx->error = 1; 175| 0| return NULL; 176| 0| } 177| 16.4k| } 178| | 179| 6.50M| BIGNUM *ret = sk_BIGNUM_value(ctx->bignums, ctx->used); 180| 6.50M| BN_zero(ret); 181| | // This is bounded by |sk_BIGNUM_num|, so it cannot overflow. 182| 6.50M| ctx->used++; 183| 6.50M| return ret; 184| 6.50M|} BN_CTX_end: 186| 3.40M|void BN_CTX_end(BN_CTX *ctx) { 187| 3.40M| if (ctx->error) { ------------------ | Branch (187:7): [True: 0, False: 3.40M] ------------------ 188| | // Once an operation has failed, |ctx->stack| no longer matches the number 189| | // of |BN_CTX_end| calls to come. Do nothing. 190| 0| return; 191| 0| } 192| | 193| 3.40M| ctx->used = BN_STACK_pop(&ctx->stack); 194| 3.40M|} bcm.c:BN_STACK_init: 199| 682|static void BN_STACK_init(BN_STACK *st) { 200| 682| st->indexes = NULL; 201| 682| st->depth = st->size = 0; 202| 682|} bcm.c:BN_STACK_cleanup: 204| 682|static void BN_STACK_cleanup(BN_STACK *st) { 205| 682| OPENSSL_free(st->indexes); 206| 682|} bcm.c:BN_STACK_push: 208| 3.40M|static int BN_STACK_push(BN_STACK *st, size_t idx) { 209| 3.40M| if (st->depth == st->size) { ------------------ | Branch (209:7): [True: 682, False: 3.40M] ------------------ 210| | // This function intentionally does not push to the error queue on error. 211| | // Error-reporting is deferred to |BN_CTX_get|. 212| 682| size_t new_size = st->size != 0 ? st->size * 3 / 2 : BN_CTX_START_FRAMES; ------------------ | | 67| 682|#define BN_CTX_START_FRAMES 32 ------------------ | Branch (212:23): [True: 0, False: 682] ------------------ 213| 682| if (new_size <= st->size || new_size > ((size_t)-1) / sizeof(size_t)) { ------------------ | Branch (213:9): [True: 0, False: 682] | Branch (213:33): [True: 0, False: 682] ------------------ 214| 0| return 0; 215| 0| } 216| 682| size_t *new_indexes = 217| 682| OPENSSL_realloc(st->indexes, new_size * sizeof(size_t)); 218| 682| if (new_indexes == NULL) { ------------------ | Branch (218:9): [True: 0, False: 682] ------------------ 219| 0| return 0; 220| 0| } 221| 682| st->indexes = new_indexes; 222| 682| st->size = new_size; 223| 682| } 224| | 225| 3.40M| st->indexes[st->depth] = idx; 226| 3.40M| st->depth++; 227| 3.40M| return 1; 228| 3.40M|} bcm.c:BN_STACK_pop: 230| 3.40M|static size_t BN_STACK_pop(BN_STACK *st) { 231| 3.40M| assert(st->depth > 0); 232| 3.40M| st->depth--; 233| 3.40M| return st->indexes[st->depth]; 234| 3.40M|} BN_div: 195| 1.03M| const BIGNUM *divisor, BN_CTX *ctx) { 196| 1.03M| int norm_shift, loop; 197| 1.03M| BIGNUM wnum; 198| 1.03M| BN_ULONG *resp, *wnump; 199| 1.03M| BN_ULONG d0, d1; 200| 1.03M| int num_n, div_n; 201| | 202| | // This function relies on the historical minimal-width |BIGNUM| invariant. 203| | // It is already not constant-time (constant-time reductions should use 204| | // Montgomery logic), so we shrink all inputs and intermediate values to 205| | // retain the previous behavior. 206| | 207| | // Invalid zero-padding would have particularly bad consequences. 208| 1.03M| int numerator_width = bn_minimal_width(numerator); 209| 1.03M| int divisor_width = bn_minimal_width(divisor); 210| 1.03M| if ((numerator_width > 0 && numerator->d[numerator_width - 1] == 0) || ------------------ | Branch (210:8): [True: 1.03M, False: 4] | Branch (210:31): [True: 0, False: 1.03M] ------------------ 211| 1.03M| (divisor_width > 0 && divisor->d[divisor_width - 1] == 0)) { ------------------ | Branch (211:8): [True: 1.03M, False: 0] | Branch (211:29): [True: 0, False: 1.03M] ------------------ 212| 0| OPENSSL_PUT_ERROR(BN, BN_R_NOT_INITIALIZED); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 213| 0| return 0; 214| 0| } 215| | 216| 1.03M| if (BN_is_zero(divisor)) { ------------------ | Branch (216:7): [True: 0, False: 1.03M] ------------------ 217| 0| OPENSSL_PUT_ERROR(BN, BN_R_DIV_BY_ZERO); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 218| 0| return 0; 219| 0| } 220| | 221| 1.03M| BN_CTX_start(ctx); 222| 1.03M| BIGNUM *tmp = BN_CTX_get(ctx); 223| 1.03M| BIGNUM *snum = BN_CTX_get(ctx); 224| 1.03M| BIGNUM *sdiv = BN_CTX_get(ctx); 225| 1.03M| BIGNUM *res = NULL; 226| 1.03M| if (quotient == NULL) { ------------------ | Branch (226:7): [True: 1.03M, False: 0] ------------------ 227| 1.03M| res = BN_CTX_get(ctx); 228| 1.03M| } else { 229| 0| res = quotient; 230| 0| } 231| 1.03M| if (sdiv == NULL || res == NULL) { ------------------ | Branch (231:7): [True: 0, False: 1.03M] | Branch (231:23): [True: 0, False: 1.03M] ------------------ 232| 0| goto err; 233| 0| } 234| | 235| | // First we normalise the numbers 236| 1.03M| norm_shift = BN_BITS2 - (BN_num_bits(divisor) % BN_BITS2); ------------------ | | 151| 1.03M|#define BN_BITS2 64 ------------------ norm_shift = BN_BITS2 - (BN_num_bits(divisor) % BN_BITS2); ------------------ | | 151| 1.03M|#define BN_BITS2 64 ------------------ 237| 1.03M| if (!BN_lshift(sdiv, divisor, norm_shift)) { ------------------ | Branch (237:7): [True: 0, False: 1.03M] ------------------ 238| 0| goto err; 239| 0| } 240| 1.03M| bn_set_minimal_width(sdiv); 241| 1.03M| sdiv->neg = 0; 242| 1.03M| norm_shift += BN_BITS2; ------------------ | | 151| 1.03M|#define BN_BITS2 64 ------------------ 243| 1.03M| if (!BN_lshift(snum, numerator, norm_shift)) { ------------------ | Branch (243:7): [True: 0, False: 1.03M] ------------------ 244| 0| goto err; 245| 0| } 246| 1.03M| bn_set_minimal_width(snum); 247| 1.03M| snum->neg = 0; 248| | 249| | // Since we don't want to have special-case logic for the case where snum is 250| | // larger than sdiv, we pad snum with enough zeroes without changing its 251| | // value. 252| 1.03M| if (snum->width <= sdiv->width + 1) { ------------------ | Branch (252:7): [True: 849, False: 1.03M] ------------------ 253| 849| if (!bn_wexpand(snum, sdiv->width + 2)) { ------------------ | Branch (253:9): [True: 0, False: 849] ------------------ 254| 0| goto err; 255| 0| } 256| 1.86k| for (int i = snum->width; i < sdiv->width + 2; i++) { ------------------ | Branch (256:31): [True: 1.01k, False: 849] ------------------ 257| 1.01k| snum->d[i] = 0; 258| 1.01k| } 259| 849| snum->width = sdiv->width + 2; 260| 1.03M| } else { 261| 1.03M| if (!bn_wexpand(snum, snum->width + 1)) { ------------------ | Branch (261:9): [True: 0, False: 1.03M] ------------------ 262| 0| goto err; 263| 0| } 264| 1.03M| snum->d[snum->width] = 0; 265| 1.03M| snum->width++; 266| 1.03M| } 267| | 268| 1.03M| div_n = sdiv->width; 269| 1.03M| num_n = snum->width; 270| 1.03M| loop = num_n - div_n; 271| | // Lets setup a 'window' into snum 272| | // This is the part that corresponds to the current 273| | // 'area' being divided 274| 1.03M| wnum.neg = 0; 275| 1.03M| wnum.d = &(snum->d[loop]); 276| 1.03M| wnum.width = div_n; 277| | // only needed when BN_ucmp messes up the values between width and max 278| 1.03M| wnum.dmax = snum->dmax - loop; // so we don't step out of bounds 279| | 280| | // Get the top 2 words of sdiv 281| | // div_n=sdiv->width; 282| 1.03M| d0 = sdiv->d[div_n - 1]; 283| 1.03M| d1 = (div_n == 1) ? 0 : sdiv->d[div_n - 2]; ------------------ | Branch (283:8): [True: 9.38k, False: 1.02M] ------------------ 284| | 285| | // pointer to the 'top' of snum 286| 1.03M| wnump = &(snum->d[num_n - 1]); 287| | 288| | // Setup |res|. |numerator| and |res| may alias, so we save |numerator->neg| 289| | // for later. 290| 1.03M| const int numerator_neg = numerator->neg; 291| 1.03M| res->neg = (numerator_neg ^ divisor->neg); 292| 1.03M| if (!bn_wexpand(res, loop + 1)) { ------------------ | Branch (292:7): [True: 0, False: 1.03M] ------------------ 293| 0| goto err; 294| 0| } 295| 1.03M| res->width = loop - 1; 296| 1.03M| resp = &(res->d[loop - 1]); 297| | 298| | // space for temp 299| 1.03M| if (!bn_wexpand(tmp, div_n + 1)) { ------------------ | Branch (299:7): [True: 0, False: 1.03M] ------------------ 300| 0| goto err; 301| 0| } 302| | 303| | // if res->width == 0 then clear the neg value otherwise decrease 304| | // the resp pointer 305| 1.03M| if (res->width == 0) { ------------------ | Branch (305:7): [True: 0, False: 1.03M] ------------------ 306| 0| res->neg = 0; 307| 1.03M| } else { 308| 1.03M| resp--; 309| 1.03M| } 310| | 311| 6.17M| for (int i = 0; i < loop - 1; i++, wnump--, resp--) { ------------------ | Branch (311:19): [True: 5.14M, False: 1.03M] ------------------ 312| 5.14M| BN_ULONG q, l0; 313| | // the first part of the loop uses the top two words of snum and sdiv to 314| | // calculate a BN_ULONG q such that | wnum - sdiv * q | < sdiv 315| 5.14M| BN_ULONG n0, n1, rm = 0; 316| | 317| 5.14M| n0 = wnump[0]; 318| 5.14M| n1 = wnump[-1]; 319| 5.14M| if (n0 == d0) { ------------------ | Branch (319:9): [True: 19.5k, False: 5.12M] ------------------ 320| 19.5k| q = BN_MASK2; ------------------ | | 154| 19.5k|#define BN_MASK2 (0xffffffffffffffffUL) ------------------ 321| 5.12M| } else { 322| | // n0 < d0 323| 5.12M| bn_div_rem_words(&q, &rm, n0, n1, d0); 324| | 325| 5.12M|#ifdef BN_ULLONG 326| 5.12M| BN_ULLONG t2 = (BN_ULLONG)d1 * q; ------------------ | | 145| 5.12M|#define BN_ULLONG uint128_t ------------------ 327| 5.12M| for (;;) { 328| 5.12M| if (t2 <= ((((BN_ULLONG)rm) << BN_BITS2) | wnump[-2])) { ------------------ | | 151| 5.12M|#define BN_BITS2 64 ------------------ | Branch (328:13): [True: 3.56M, False: 1.56M] ------------------ 329| 3.56M| break; 330| 3.56M| } 331| 1.56M| q--; 332| 1.56M| rm += d0; 333| 1.56M| if (rm < d0) { ------------------ | Branch (333:13): [True: 1.56M, False: 20] ------------------ 334| 1.56M| break; // don't let rm overflow 335| 1.56M| } 336| 20| t2 -= d1; 337| 20| } 338| |#else // !BN_ULLONG 339| | BN_ULONG t2l, t2h; 340| | BN_UMULT_LOHI(t2l, t2h, d1, q); 341| | for (;;) { 342| | if (t2h < rm || 343| | (t2h == rm && t2l <= wnump[-2])) { 344| | break; 345| | } 346| | q--; 347| | rm += d0; 348| | if (rm < d0) { 349| | break; // don't let rm overflow 350| | } 351| | if (t2l < d1) { 352| | t2h--; 353| | } 354| | t2l -= d1; 355| | } 356| |#endif // !BN_ULLONG 357| 5.12M| } 358| | 359| 5.14M| l0 = bn_mul_words(tmp->d, sdiv->d, div_n, q); 360| 5.14M| tmp->d[div_n] = l0; 361| 5.14M| wnum.d--; 362| | // ingore top values of the bignums just sub the two 363| | // BN_ULONG arrays with bn_sub_words 364| 5.14M| if (bn_sub_words(wnum.d, wnum.d, tmp->d, div_n + 1)) { ------------------ | Branch (364:9): [True: 19.6k, False: 5.12M] ------------------ 365| | // Note: As we have considered only the leading 366| | // two BN_ULONGs in the calculation of q, sdiv * q 367| | // might be greater than wnum (but then (q-1) * sdiv 368| | // is less or equal than wnum) 369| 19.6k| q--; 370| 19.6k| if (bn_add_words(wnum.d, wnum.d, sdiv->d, div_n)) { ------------------ | Branch (370:11): [True: 19.6k, False: 0] ------------------ 371| | // we can't have an overflow here (assuming 372| | // that q != 0, but if q == 0 then tmp is 373| | // zero anyway) 374| 19.6k| (*wnump)++; 375| 19.6k| } 376| 19.6k| } 377| | // store part of the result 378| 5.14M| *resp = q; 379| 5.14M| } 380| | 381| 1.03M| bn_set_minimal_width(snum); 382| | 383| 1.03M| if (rem != NULL) { ------------------ | Branch (383:7): [True: 1.03M, False: 0] ------------------ 384| 1.03M| if (!BN_rshift(rem, snum, norm_shift)) { ------------------ | Branch (384:9): [True: 0, False: 1.03M] ------------------ 385| 0| goto err; 386| 0| } 387| 1.03M| if (!BN_is_zero(rem)) { ------------------ | Branch (387:9): [True: 1.02M, False: 5.52k] ------------------ 388| 1.02M| rem->neg = numerator_neg; 389| 1.02M| } 390| 1.03M| } 391| | 392| 1.03M| bn_set_minimal_width(res); 393| 1.03M| BN_CTX_end(ctx); 394| 1.03M| return 1; 395| | 396| 0|err: 397| 0| BN_CTX_end(ctx); 398| 0| return 0; 399| 1.03M|} BN_nnmod: 401| 992k|int BN_nnmod(BIGNUM *r, const BIGNUM *m, const BIGNUM *d, BN_CTX *ctx) { 402| 992k| if (!(BN_mod(r, m, d, ctx))) { ------------------ | | 547| 992k| BN_div(NULL, (rem), (numerator), (divisor), (ctx)) ------------------ | Branch (402:7): [True: 0, False: 992k] ------------------ 403| 0| return 0; 404| 0| } 405| 992k| if (!r->neg) { ------------------ | Branch (405:7): [True: 992k, False: 0] ------------------ 406| 992k| return 1; 407| 992k| } 408| | 409| | // now -|d| < r < 0, so we have to set r := r + |d|. 410| 0| return (d->neg ? BN_sub : BN_add)(r, r, d); ------------------ | Branch (410:11): [True: 0, False: 0] ------------------ 411| 992k|} bn_reduce_once: 414| 2.23k| const BN_ULONG *m, size_t num) { 415| 2.23k| assert(r != a); 416| | // |r| = |a| - |m|. |bn_sub_words| performs the bulk of the subtraction, and 417| | // then we apply the borrow to |carry|. 418| 2.23k| carry -= bn_sub_words(r, a, m, num); 419| | // We know 0 <= |a| < 2*|m|, so -|m| <= |r| < |m|. 420| | // 421| | // If 0 <= |r| < |m|, |r| fits in |num| words and |carry| is zero. We then 422| | // wish to select |r| as the answer. Otherwise -m <= r < 0 and we wish to 423| | // return |r| + |m|, or |a|. |carry| must then be -1 or all ones. In both 424| | // cases, |carry| is a suitable input to |bn_select_words|. 425| | // 426| | // Although |carry| may be one if it was one on input and |bn_sub_words| 427| | // returns zero, this would give |r| > |m|, violating our input assumptions. 428| 2.23k| assert(carry == 0 || carry == (BN_ULONG)-1); 429| 2.23k| bn_select_words(r, carry, a /* r < 0 */, r /* r >= 0 */, num); 430| 2.23k| return carry; 431| 2.23k|} bn_reduce_once_in_place: 434| 361k| BN_ULONG *tmp, size_t num) { 435| | // See |bn_reduce_once| for why this logic works. 436| 361k| carry -= bn_sub_words(tmp, r, m, num); 437| 361k| assert(carry == 0 || carry == (BN_ULONG)-1); 438| 361k| bn_select_words(r, carry, r /* tmp < 0 */, tmp /* tmp >= 0 */, num); 439| 361k| return carry; 440| 361k|} bn_mod_sub_words: 443| 671| const BN_ULONG *m, BN_ULONG *tmp, size_t num) { 444| | // r = a - b 445| 671| BN_ULONG borrow = bn_sub_words(r, a, b, num); 446| | // tmp = a - b + m 447| 671| bn_add_words(tmp, r, m, num); 448| 671| bn_select_words(r, 0 - borrow, tmp /* r < 0 */, r /* r >= 0 */, num); 449| 671|} bn_mod_add_words: 452| 361k| const BN_ULONG *m, BN_ULONG *tmp, size_t num) { 453| 361k| BN_ULONG carry = bn_add_words(r, a, b, num); 454| 361k| bn_reduce_once_in_place(r, carry, m, tmp, num); 455| 361k|} bn_mod_add_consttime: 598| 360k| const BIGNUM *m, BN_CTX *ctx) { 599| 360k| BN_CTX_start(ctx); 600| 360k| a = bn_resized_from_ctx(a, m->width, ctx); 601| 360k| b = bn_resized_from_ctx(b, m->width, ctx); 602| 360k| BIGNUM *tmp = bn_scratch_space_from_ctx(m->width, ctx); 603| 360k| int ok = a != NULL && b != NULL && tmp != NULL && ------------------ | Branch (603:12): [True: 360k, False: 0] | Branch (603:25): [True: 360k, False: 0] | Branch (603:38): [True: 360k, False: 0] ------------------ 604| 360k| bn_wexpand(r, m->width); ------------------ | Branch (604:12): [True: 360k, False: 0] ------------------ 605| 360k| if (ok) { ------------------ | Branch (605:7): [True: 360k, False: 0] ------------------ 606| 360k| bn_mod_add_words(r->d, a->d, b->d, m->d, tmp->d, m->width); 607| 360k| r->width = m->width; 608| 360k| r->neg = 0; 609| 360k| } 610| 360k| BN_CTX_end(ctx); 611| 360k| return ok; 612| 360k|} bn_mod_sub_consttime: 623| 671| const BIGNUM *m, BN_CTX *ctx) { 624| 671| BN_CTX_start(ctx); 625| 671| a = bn_resized_from_ctx(a, m->width, ctx); 626| 671| b = bn_resized_from_ctx(b, m->width, ctx); 627| 671| BIGNUM *tmp = bn_scratch_space_from_ctx(m->width, ctx); 628| 671| int ok = a != NULL && b != NULL && tmp != NULL && ------------------ | Branch (628:12): [True: 671, False: 0] | Branch (628:25): [True: 671, False: 0] | Branch (628:38): [True: 671, False: 0] ------------------ 629| 671| bn_wexpand(r, m->width); ------------------ | Branch (629:12): [True: 671, False: 0] ------------------ 630| 671| if (ok) { ------------------ | Branch (630:7): [True: 671, False: 0] ------------------ 631| 671| bn_mod_sub_words(r->d, a->d, b->d, m->d, tmp->d, m->width); 632| 671| r->width = m->width; 633| 671| r->neg = 0; 634| 671| } 635| 671| BN_CTX_end(ctx); 636| 671| return ok; 637| 671|} BN_mod_mul: 649| 982k| BN_CTX *ctx) { 650| 982k| BIGNUM *t; 651| 982k| int ret = 0; 652| | 653| 982k| BN_CTX_start(ctx); 654| 982k| t = BN_CTX_get(ctx); 655| 982k| if (t == NULL) { ------------------ | Branch (655:7): [True: 0, False: 982k] ------------------ 656| 0| goto err; 657| 0| } 658| | 659| 982k| if (a == b) { ------------------ | Branch (659:7): [True: 941k, False: 40.3k] ------------------ 660| 941k| if (!BN_sqr(t, a, ctx)) { ------------------ | Branch (660:9): [True: 0, False: 941k] ------------------ 661| 0| goto err; 662| 0| } 663| 941k| } else { 664| 40.3k| if (!BN_mul(t, a, b, ctx)) { ------------------ | Branch (664:9): [True: 0, False: 40.3k] ------------------ 665| 0| goto err; 666| 0| } 667| 40.3k| } 668| | 669| 982k| if (!BN_nnmod(r, t, m, ctx)) { ------------------ | Branch (669:7): [True: 0, False: 982k] ------------------ 670| 0| goto err; 671| 0| } 672| | 673| 982k| ret = 1; 674| | 675| 982k|err: 676| 982k| BN_CTX_end(ctx); 677| 982k| return ret; 678| 982k|} BN_mod_sqr: 680| 39.7k|int BN_mod_sqr(BIGNUM *r, const BIGNUM *a, const BIGNUM *m, BN_CTX *ctx) { 681| 39.7k| if (!BN_sqr(r, a, ctx)) { ------------------ | Branch (681:7): [True: 0, False: 39.7k] ------------------ 682| 0| return 0; 683| 0| } 684| | 685| | // r->neg == 0, thus we don't need BN_nnmod 686| 39.7k| return BN_mod(r, r, m, ctx); ------------------ | | 547| 39.7k| BN_div(NULL, (rem), (numerator), (divisor), (ctx)) ------------------ 687| 39.7k|} bn_mod_lshift_consttime: 713| 1.22k| BN_CTX *ctx) { 714| 1.22k| if (!BN_copy(r, a)) { ------------------ | Branch (714:7): [True: 0, False: 1.22k] ------------------ 715| 0| return 0; 716| 0| } 717| 360k| for (int i = 0; i < n; i++) { ------------------ | Branch (717:19): [True: 358k, False: 1.22k] ------------------ 718| 358k| if (!bn_mod_lshift1_consttime(r, r, m, ctx)) { ------------------ | Branch (718:9): [True: 0, False: 358k] ------------------ 719| 0| return 0; 720| 0| } 721| 358k| } 722| 1.22k| return 1; 723| 1.22k|} bn_mod_lshift1_consttime: 742| 359k| BN_CTX *ctx) { 743| 359k| return bn_mod_add_consttime(r, a, a, m, ctx); 744| 359k|} bcm.c:bn_div_rem_words: 140| 5.12M| BN_ULONG n0, BN_ULONG n1, BN_ULONG d0) { 141| | // GCC and Clang generate function calls to |__udivdi3| and |__umoddi3| when 142| | // the |BN_ULLONG|-based C code is used. 143| | // 144| | // GCC bugs: 145| | // * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=14224 146| | // * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=43721 147| | // * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=54183 148| | // * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=58897 149| | // * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65668 150| | // 151| | // Clang bugs: 152| | // * https://llvm.org/bugs/show_bug.cgi?id=6397 153| | // * https://llvm.org/bugs/show_bug.cgi?id=12418 154| | // 155| | // These issues aren't specific to x86 and x86_64, so it might be worthwhile 156| | // to add more assembly language implementations. 157| |#if defined(BN_CAN_USE_INLINE_ASM) && defined(OPENSSL_X86) 158| | __asm__ volatile("divl %4" 159| | : "=a"(*quotient_out), "=d"(*rem_out) 160| | : "a"(n1), "d"(n0), "rm"(d0) 161| | : "cc"); 162| |#elif defined(BN_CAN_USE_INLINE_ASM) && defined(OPENSSL_X86_64) 163| 5.12M| __asm__ volatile("divq %4" 164| 5.12M| : "=a"(*quotient_out), "=d"(*rem_out) 165| 5.12M| : "a"(n1), "d"(n0), "rm"(d0) 166| 5.12M| : "cc"); 167| |#else 168| |#if defined(BN_CAN_DIVIDE_ULLONG) 169| | BN_ULLONG n = (((BN_ULLONG)n0) << BN_BITS2) | n1; 170| | *quotient_out = (BN_ULONG)(n / d0); 171| |#else 172| | *quotient_out = bn_div_words(n0, n1, d0); 173| |#endif 174| | *rem_out = n1 - (*quotient_out * d0); 175| |#endif 176| 5.12M|} bcm.c:bn_resized_from_ctx: 565| 723k| BN_CTX *ctx) { 566| 723k| if ((size_t)bn->width >= width) { ------------------ | Branch (566:7): [True: 723k, False: 66] ------------------ 567| | // Any excess words must be zero. 568| 723k| assert(bn_fits_in_words(bn, width)); 569| 723k| return bn; 570| 723k| } 571| 66| BIGNUM *ret = bn_scratch_space_from_ctx(width, ctx); 572| 66| if (ret == NULL || ------------------ | Branch (572:7): [True: 0, False: 66] ------------------ 573| 66| !BN_copy(ret, bn) || ------------------ | Branch (573:7): [True: 0, False: 66] ------------------ 574| 66| !bn_resize_words(ret, width)) { ------------------ | Branch (574:7): [True: 0, False: 66] ------------------ 575| 0| return NULL; 576| 0| } 577| 66| return ret; 578| 66|} bcm.c:bn_scratch_space_from_ctx: 548| 361k|static BIGNUM *bn_scratch_space_from_ctx(size_t width, BN_CTX *ctx) { 549| 361k| BIGNUM *ret = BN_CTX_get(ctx); 550| 361k| if (ret == NULL || ------------------ | Branch (550:7): [True: 0, False: 361k] ------------------ 551| 361k| !bn_wexpand(ret, width)) { ------------------ | Branch (551:7): [True: 0, False: 361k] ------------------ 552| 0| return NULL; 553| 0| } 554| 361k| ret->neg = 0; 555| 361k| ret->width = (int)width; 556| 361k| return ret; 557| 361k|} BN_mod_exp_mont: 588| 1.22k| const BIGNUM *m, BN_CTX *ctx, const BN_MONT_CTX *mont) { 589| 1.22k| if (!BN_is_odd(m)) { ------------------ | Branch (589:7): [True: 0, False: 1.22k] ------------------ 590| 0| OPENSSL_PUT_ERROR(BN, BN_R_CALLED_WITH_EVEN_MODULUS); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 591| 0| return 0; 592| 0| } 593| 1.22k| if (m->neg) { ------------------ | Branch (593:7): [True: 0, False: 1.22k] ------------------ 594| 0| OPENSSL_PUT_ERROR(BN, BN_R_NEGATIVE_NUMBER); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 595| 0| return 0; 596| 0| } 597| | // |a| is secret, but |a < m| is not. 598| 1.22k| if (a->neg || constant_time_declassify_int(BN_ucmp(a, m)) >= 0) { ------------------ | Branch (598:7): [True: 0, False: 1.22k] | Branch (598:17): [True: 0, False: 1.22k] ------------------ 599| 0| OPENSSL_PUT_ERROR(BN, BN_R_INPUT_NOT_REDUCED); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 600| 0| return 0; 601| 0| } 602| | 603| 1.22k| int bits = BN_num_bits(p); 604| 1.22k| if (bits == 0) { ------------------ | Branch (604:7): [True: 0, False: 1.22k] ------------------ 605| | // x**0 mod 1 is still zero. 606| 0| if (BN_abs_is_word(m, 1)) { ------------------ | Branch (606:9): [True: 0, False: 0] ------------------ 607| 0| BN_zero(rr); 608| 0| return 1; 609| 0| } 610| 0| return BN_one(rr); 611| 0| } 612| | 613| 1.22k| int ret = 0; 614| 1.22k| BIGNUM *val[TABLE_SIZE]; 615| 1.22k| BN_MONT_CTX *new_mont = NULL; 616| | 617| 1.22k| BN_CTX_start(ctx); 618| 1.22k| BIGNUM *r = BN_CTX_get(ctx); 619| 1.22k| val[0] = BN_CTX_get(ctx); 620| 1.22k| if (r == NULL || val[0] == NULL) { ------------------ | Branch (620:7): [True: 0, False: 1.22k] | Branch (620:20): [True: 0, False: 1.22k] ------------------ 621| 0| goto err; 622| 0| } 623| | 624| | // Allocate a montgomery context if it was not supplied by the caller. 625| 1.22k| if (mont == NULL) { ------------------ | Branch (625:7): [True: 1.22k, False: 0] ------------------ 626| 1.22k| new_mont = BN_MONT_CTX_new_consttime(m, ctx); 627| 1.22k| if (new_mont == NULL) { ------------------ | Branch (627:9): [True: 0, False: 1.22k] ------------------ 628| 0| goto err; 629| 0| } 630| 1.22k| mont = new_mont; 631| 1.22k| } 632| | 633| | // We exponentiate by looking at sliding windows of the exponent and 634| | // precomputing powers of |a|. Windows may be shifted so they always end on a 635| | // set bit, so only precompute odd powers. We compute val[i] = a^(2*i + 1) 636| | // for i = 0 to 2^(window-1), all in Montgomery form. 637| 1.22k| int window = BN_window_bits_for_exponent_size(bits); 638| 1.22k| if (!BN_to_montgomery(val[0], a, mont, ctx)) { ------------------ | Branch (638:7): [True: 0, False: 1.22k] ------------------ 639| 0| goto err; 640| 0| } 641| 1.22k| if (window > 1) { ------------------ | Branch (641:7): [True: 1.22k, False: 0] ------------------ 642| 1.22k| BIGNUM *d = BN_CTX_get(ctx); 643| 1.22k| if (d == NULL || ------------------ | Branch (643:9): [True: 0, False: 1.22k] ------------------ 644| 1.22k| !BN_mod_mul_montgomery(d, val[0], val[0], mont, ctx)) { ------------------ | Branch (644:9): [True: 0, False: 1.22k] ------------------ 645| 0| goto err; 646| 0| } 647| 10.7k| for (int i = 1; i < 1 << (window - 1); i++) { ------------------ | Branch (647:21): [True: 9.51k, False: 1.22k] ------------------ 648| 9.51k| val[i] = BN_CTX_get(ctx); 649| 9.51k| if (val[i] == NULL || ------------------ | Branch (649:11): [True: 0, False: 9.51k] ------------------ 650| 9.51k| !BN_mod_mul_montgomery(val[i], val[i - 1], d, mont, ctx)) { ------------------ | Branch (650:11): [True: 0, False: 9.51k] ------------------ 651| 0| goto err; 652| 0| } 653| 9.51k| } 654| 1.22k| } 655| | 656| | // |p| is non-zero, so at least one window is non-zero. To save some 657| | // multiplications, defer initializing |r| until then. 658| 1.22k| int r_is_one = 1; 659| 1.22k| int wstart = bits - 1; // The top bit of the window. 660| 63.2k| for (;;) { 661| 63.2k| if (!BN_is_bit_set(p, wstart)) { ------------------ | Branch (661:9): [True: 25.1k, False: 38.1k] ------------------ 662| 25.1k| if (!r_is_one && !BN_mod_mul_montgomery(r, r, r, mont, ctx)) { ------------------ | Branch (662:11): [True: 25.1k, False: 0] | Branch (662:24): [True: 0, False: 25.1k] ------------------ 663| 0| goto err; 664| 0| } 665| 25.1k| if (wstart == 0) { ------------------ | Branch (665:11): [True: 119, False: 24.9k] ------------------ 666| 119| break; 667| 119| } 668| 24.9k| wstart--; 669| 24.9k| continue; 670| 25.1k| } 671| | 672| | // We now have wstart on a set bit. Find the largest window we can use. 673| 38.1k| int wvalue = 1; 674| 38.1k| int wsize = 0; 675| 154k| for (int i = 1; i < window && i <= wstart; i++) { ------------------ | Branch (675:21): [True: 117k, False: 37.6k] | Branch (675:35): [True: 116k, False: 552] ------------------ 676| 116k| if (BN_is_bit_set(p, wstart - i)) { ------------------ | Branch (676:11): [True: 115k, False: 1.07k] ------------------ 677| 115k| wvalue <<= (i - wsize); 678| 115k| wvalue |= 1; 679| 115k| wsize = i; 680| 115k| } 681| 116k| } 682| | 683| | // Shift |r| to the end of the window. 684| 38.1k| if (!r_is_one) { ------------------ | Branch (684:9): [True: 36.9k, False: 1.22k] ------------------ 685| 185k| for (int i = 0; i < wsize + 1; i++) { ------------------ | Branch (685:23): [True: 148k, False: 36.9k] ------------------ 686| 148k| if (!BN_mod_mul_montgomery(r, r, r, mont, ctx)) { ------------------ | Branch (686:13): [True: 0, False: 148k] ------------------ 687| 0| goto err; 688| 0| } 689| 148k| } 690| 36.9k| } 691| | 692| 38.1k| assert(wvalue & 1); 693| 38.1k| assert(wvalue < (1 << window)); 694| 38.1k| if (r_is_one) { ------------------ | Branch (694:9): [True: 1.22k, False: 36.9k] ------------------ 695| 1.22k| if (!BN_copy(r, val[wvalue >> 1])) { ------------------ | Branch (695:11): [True: 0, False: 1.22k] ------------------ 696| 0| goto err; 697| 0| } 698| 36.9k| } else if (!BN_mod_mul_montgomery(r, r, val[wvalue >> 1], mont, ctx)) { ------------------ | Branch (698:16): [True: 0, False: 36.9k] ------------------ 699| 0| goto err; 700| 0| } 701| | 702| 38.1k| r_is_one = 0; 703| 38.1k| if (wstart == wsize) { ------------------ | Branch (703:9): [True: 1.10k, False: 37.0k] ------------------ 704| 1.10k| break; 705| 1.10k| } 706| 37.0k| wstart -= wsize + 1; 707| 37.0k| } 708| | 709| | // |p| is non-zero, so |r_is_one| must be cleared at some point. 710| 1.22k| assert(!r_is_one); 711| | 712| 1.22k| if (!BN_from_montgomery(rr, r, mont, ctx)) { ------------------ | Branch (712:7): [True: 0, False: 1.22k] ------------------ 713| 0| goto err; 714| 0| } 715| 1.22k| ret = 1; 716| | 717| 1.22k|err: 718| 1.22k| BN_MONT_CTX_free(new_mont); 719| 1.22k| BN_CTX_end(ctx); 720| 1.22k| return ret; 721| 1.22k|} bn_mod_exp_mont_small: 725| 43| const BN_MONT_CTX *mont) { 726| 43| if (num != (size_t)mont->N.width || num > BN_SMALL_MAX_WORDS || ------------------ | | 684| 86|#define BN_SMALL_MAX_WORDS 9 ------------------ | Branch (726:7): [True: 0, False: 43] | Branch (726:39): [True: 0, False: 43] ------------------ 727| 43| num_p > ((size_t)-1) / BN_BITS2) { ------------------ | | 151| 43|#define BN_BITS2 64 ------------------ | Branch (727:7): [True: 0, False: 43] ------------------ 728| 0| abort(); 729| 0| } 730| 43| assert(BN_is_odd(&mont->N)); 731| | 732| | // Count the number of bits in |p|, skipping leading zeros. Note this function 733| | // treats |p| as public. 734| 43| while (num_p != 0 && p[num_p - 1] == 0) { ------------------ | Branch (734:10): [True: 43, False: 0] | Branch (734:24): [True: 0, False: 43] ------------------ 735| 0| num_p--; 736| 0| } 737| 43| if (num_p == 0) { ------------------ | Branch (737:7): [True: 0, False: 43] ------------------ 738| 0| bn_from_montgomery_small(r, num, mont->RR.d, num, mont); 739| 0| return; 740| 0| } 741| 43| size_t bits = BN_num_bits_word(p[num_p - 1]) + (num_p - 1) * BN_BITS2; ------------------ | | 151| 43|#define BN_BITS2 64 ------------------ 742| 43| assert(bits != 0); 743| | 744| | // We exponentiate by looking at sliding windows of the exponent and 745| | // precomputing powers of |a|. Windows may be shifted so they always end on a 746| | // set bit, so only precompute odd powers. We compute val[i] = a^(2*i + 1) for 747| | // i = 0 to 2^(window-1), all in Montgomery form. 748| 43| unsigned window = BN_window_bits_for_exponent_size(bits); 749| 43| if (window > TABLE_BITS_SMALL) { ------------------ | | 424| 43|#define TABLE_BITS_SMALL 5 ------------------ | Branch (749:7): [True: 0, False: 43] ------------------ 750| 0| window = TABLE_BITS_SMALL; // Tolerate excessively large |p|. ------------------ | | 424| 0|#define TABLE_BITS_SMALL 5 ------------------ 751| 0| } 752| 43| BN_ULONG val[TABLE_SIZE_SMALL][BN_SMALL_MAX_WORDS]; 753| 43| OPENSSL_memcpy(val[0], a, num * sizeof(BN_ULONG)); 754| 43| if (window > 1) { ------------------ | Branch (754:7): [True: 43, False: 0] ------------------ 755| 43| BN_ULONG d[BN_SMALL_MAX_WORDS]; 756| 43| bn_mod_mul_montgomery_small(d, val[0], val[0], num, mont); 757| 688| for (unsigned i = 1; i < 1u << (window - 1); i++) { ------------------ | Branch (757:26): [True: 645, False: 43] ------------------ 758| 645| bn_mod_mul_montgomery_small(val[i], val[i - 1], d, num, mont); 759| 645| } 760| 43| } 761| | 762| | // |p| is non-zero, so at least one window is non-zero. To save some 763| | // multiplications, defer initializing |r| until then. 764| 43| int r_is_one = 1; 765| 43| size_t wstart = bits - 1; // The top bit of the window. 766| 5.38k| for (;;) { 767| 5.38k| if (!bn_is_bit_set_words(p, num_p, wstart)) { ------------------ | Branch (767:9): [True: 2.18k, False: 3.19k] ------------------ 768| 2.18k| if (!r_is_one) { ------------------ | Branch (768:11): [True: 2.18k, False: 0] ------------------ 769| 2.18k| bn_mod_mul_montgomery_small(r, r, r, num, mont); 770| 2.18k| } 771| 2.18k| if (wstart == 0) { ------------------ | Branch (771:11): [True: 0, False: 2.18k] ------------------ 772| 0| break; 773| 0| } 774| 2.18k| wstart--; 775| 2.18k| continue; 776| 2.18k| } 777| | 778| | // We now have wstart on a set bit. Find the largest window we can use. 779| 3.19k| unsigned wvalue = 1; 780| 3.19k| unsigned wsize = 0; 781| 15.8k| for (unsigned i = 1; i < window && i <= wstart; i++) { ------------------ | Branch (781:26): [True: 12.6k, False: 3.15k] | Branch (781:40): [True: 12.6k, False: 43] ------------------ 782| 12.6k| if (bn_is_bit_set_words(p, num_p, wstart - i)) { ------------------ | Branch (782:11): [True: 12.4k, False: 109] ------------------ 783| 12.4k| wvalue <<= (i - wsize); 784| 12.4k| wvalue |= 1; 785| 12.4k| wsize = i; 786| 12.4k| } 787| 12.6k| } 788| | 789| | // Shift |r| to the end of the window. 790| 3.19k| if (!r_is_one) { ------------------ | Branch (790:9): [True: 3.15k, False: 43] ------------------ 791| 18.6k| for (unsigned i = 0; i < wsize + 1; i++) { ------------------ | Branch (791:28): [True: 15.4k, False: 3.15k] ------------------ 792| 15.4k| bn_mod_mul_montgomery_small(r, r, r, num, mont); 793| 15.4k| } 794| 3.15k| } 795| | 796| 3.19k| assert(wvalue & 1); 797| 3.19k| assert(wvalue < (1u << window)); 798| 3.19k| if (r_is_one) { ------------------ | Branch (798:9): [True: 43, False: 3.15k] ------------------ 799| 43| OPENSSL_memcpy(r, val[wvalue >> 1], num * sizeof(BN_ULONG)); 800| 3.15k| } else { 801| 3.15k| bn_mod_mul_montgomery_small(r, r, val[wvalue >> 1], num, mont); 802| 3.15k| } 803| 3.19k| r_is_one = 0; 804| 3.19k| if (wstart == wsize) { ------------------ | Branch (804:9): [True: 43, False: 3.15k] ------------------ 805| 43| break; 806| 43| } 807| 3.15k| wstart -= wsize + 1; 808| 3.15k| } 809| | 810| | // |p| is non-zero, so |r_is_one| must be cleared at some point. 811| 43| assert(!r_is_one); 812| 43| OPENSSL_cleanse(val, sizeof(val)); 813| 43|} bn_mod_inverse0_prime_mont_small: 816| 43| size_t num, const BN_MONT_CTX *mont) { 817| 43| if (num != (size_t)mont->N.width || num > BN_SMALL_MAX_WORDS) { ------------------ | | 684| 43|#define BN_SMALL_MAX_WORDS 9 ------------------ | Branch (817:7): [True: 0, False: 43] | Branch (817:39): [True: 0, False: 43] ------------------ 818| 0| abort(); 819| 0| } 820| | 821| | // Per Fermat's Little Theorem, a^-1 = a^(p-2) (mod p) for p prime. 822| 43| BN_ULONG p_minus_two[BN_SMALL_MAX_WORDS]; 823| 43| const BN_ULONG *p = mont->N.d; 824| 43| OPENSSL_memcpy(p_minus_two, p, num * sizeof(BN_ULONG)); 825| 43| if (p_minus_two[0] >= 2) { ------------------ | Branch (825:7): [True: 43, False: 0] ------------------ 826| 43| p_minus_two[0] -= 2; 827| 43| } else { 828| 0| p_minus_two[0] -= 2; 829| 0| for (size_t i = 1; i < num; i++) { ------------------ | Branch (829:24): [True: 0, False: 0] ------------------ 830| 0| if (p_minus_two[i]-- != 0) { ------------------ | Branch (830:11): [True: 0, False: 0] ------------------ 831| 0| break; 832| 0| } 833| 0| } 834| 0| } 835| | 836| 43| bn_mod_exp_mont_small(r, a, num, p_minus_two, num, mont); 837| 43|} bcm.c:BN_window_bits_for_exponent_size: 400| 1.26k|static int BN_window_bits_for_exponent_size(size_t b) { 401| 1.26k| if (b > 671) { ------------------ | Branch (401:7): [True: 0, False: 1.26k] ------------------ 402| 0| return 6; 403| 0| } 404| 1.26k| if (b > 239) { ------------------ | Branch (404:7): [True: 162, False: 1.10k] ------------------ 405| 162| return 5; 406| 162| } 407| 1.10k| if (b > 79) { ------------------ | Branch (407:7): [True: 1.10k, False: 0] ------------------ 408| 1.10k| return 4; 409| 1.10k| } 410| 0| if (b > 23) { ------------------ | Branch (410:7): [True: 0, False: 0] ------------------ 411| 0| return 3; 412| 0| } 413| 0| return 1; 414| 0|} bn_jacobi: 63| 5.52k|int bn_jacobi(const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx) { 64| | // In 'tab', only odd-indexed entries are relevant: 65| | // For any odd BIGNUM n, 66| | // tab[BN_lsw(n) & 7] 67| | // is $(-1)^{(n^2-1)/8}$ (using TeX notation). 68| | // Note that the sign of n does not matter. 69| 5.52k| static const int tab[8] = {0, 1, 0, -1, 0, -1, 0, 1}; 70| | 71| | // The Jacobi symbol is only defined for odd modulus. 72| 5.52k| if (!BN_is_odd(b)) { ------------------ | Branch (72:7): [True: 0, False: 5.52k] ------------------ 73| 0| OPENSSL_PUT_ERROR(BN, BN_R_CALLED_WITH_EVEN_MODULUS); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 74| 0| return -2; 75| 0| } 76| | 77| | // Require b be positive. 78| 5.52k| if (BN_is_negative(b)) { ------------------ | Branch (78:7): [True: 0, False: 5.52k] ------------------ 79| 0| OPENSSL_PUT_ERROR(BN, BN_R_NEGATIVE_NUMBER); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 80| 0| return -2; 81| 0| } 82| | 83| 5.52k| int ret = -2; 84| 5.52k| BN_CTX_start(ctx); 85| 5.52k| BIGNUM *A = BN_CTX_get(ctx); 86| 5.52k| BIGNUM *B = BN_CTX_get(ctx); 87| 5.52k| if (B == NULL) { ------------------ | Branch (87:7): [True: 0, False: 5.52k] ------------------ 88| 0| goto end; 89| 0| } 90| | 91| 5.52k| if (!BN_copy(A, a) || ------------------ | Branch (91:7): [True: 0, False: 5.52k] ------------------ 92| 5.52k| !BN_copy(B, b)) { ------------------ | Branch (92:7): [True: 0, False: 5.52k] ------------------ 93| 0| goto end; 94| 0| } 95| | 96| | // Adapted from logic to compute the Kronecker symbol, originally implemented 97| | // according to Henri Cohen, "A Course in Computational Algebraic Number 98| | // Theory" (algorithm 1.4.10). 99| | 100| 5.52k| ret = 1; 101| | 102| 14.9k| while (1) { ------------------ | Branch (102:10): [Folded - Ignored] ------------------ 103| | // Cohen's step 3: 104| | 105| | // B is positive and odd 106| 14.9k| if (BN_is_zero(A)) { ------------------ | Branch (106:9): [True: 5.52k, False: 9.38k] ------------------ 107| 5.52k| ret = BN_is_one(B) ? ret : 0; ------------------ | Branch (107:13): [True: 5.52k, False: 0] ------------------ 108| 5.52k| goto end; 109| 5.52k| } 110| | 111| | // now A is non-zero 112| 9.38k| int i = 0; 113| 17.6k| while (!BN_is_bit_set(A, i)) { ------------------ | Branch (113:12): [True: 8.28k, False: 9.38k] ------------------ 114| 8.28k| i++; 115| 8.28k| } 116| 9.38k| if (!BN_rshift(A, A, i)) { ------------------ | Branch (116:9): [True: 0, False: 9.38k] ------------------ 117| 0| ret = -2; 118| 0| goto end; 119| 0| } 120| 9.38k| if (i & 1) { ------------------ | Branch (120:9): [True: 2.76k, False: 6.62k] ------------------ 121| | // i is odd 122| | // multiply 'ret' by $(-1)^{(B^2-1)/8}$ 123| 2.76k| ret = ret * tab[BN_lsw(B) & 7]; ------------------ | | 61| 2.76k|#define BN_lsw(n) (((n)->width == 0) ? (BN_ULONG) 0 : (n)->d[0]) | | ------------------ | | | Branch (61:20): [True: 0, False: 2.76k] | | ------------------ ------------------ 124| 2.76k| } 125| | 126| | // Cohen's step 4: 127| | // multiply 'ret' by $(-1)^{(A-1)(B-1)/4}$ 128| 9.38k| if ((A->neg ? ~BN_lsw(A) : BN_lsw(A)) & BN_lsw(B) & 2) { ------------------ | | 61| 0|#define BN_lsw(n) (((n)->width == 0) ? (BN_ULONG) 0 : (n)->d[0]) | | ------------------ | | | Branch (61:20): [True: 0, False: 0] | | ------------------ ------------------ if ((A->neg ? ~BN_lsw(A) : BN_lsw(A)) & BN_lsw(B) & 2) { ------------------ | | 61| 9.38k|#define BN_lsw(n) (((n)->width == 0) ? (BN_ULONG) 0 : (n)->d[0]) | | ------------------ | | | Branch (61:20): [True: 0, False: 9.38k] | | ------------------ ------------------ if ((A->neg ? ~BN_lsw(A) : BN_lsw(A)) & BN_lsw(B) & 2) { ------------------ | | 61| 9.38k|#define BN_lsw(n) (((n)->width == 0) ? (BN_ULONG) 0 : (n)->d[0]) | | ------------------ | | | Branch (61:20): [True: 0, False: 9.38k] | | ------------------ ------------------ | Branch (128:9): [True: 0, False: 9.38k] | Branch (128:10): [True: 0, False: 9.38k] ------------------ 129| 0| ret = -ret; 130| 0| } 131| | 132| | // (A, B) := (B mod |A|, |A|) 133| 9.38k| if (!BN_nnmod(B, B, A, ctx)) { ------------------ | Branch (133:9): [True: 0, False: 9.38k] ------------------ 134| 0| ret = -2; 135| 0| goto end; 136| 0| } 137| 9.38k| BIGNUM *tmp = A; 138| 9.38k| A = B; 139| 9.38k| B = tmp; 140| 9.38k| tmp->neg = 0; 141| 9.38k| } 142| | 143| 5.52k|end: 144| 5.52k| BN_CTX_end(ctx); 145| 5.52k| return ret; 146| 5.52k|} BN_MONT_CTX_new: 124| 1.23k|BN_MONT_CTX *BN_MONT_CTX_new(void) { 125| 1.23k| BN_MONT_CTX *ret = OPENSSL_malloc(sizeof(BN_MONT_CTX)); 126| | 127| 1.23k| if (ret == NULL) { ------------------ | Branch (127:7): [True: 0, False: 1.23k] ------------------ 128| 0| return NULL; 129| 0| } 130| | 131| 1.23k| OPENSSL_memset(ret, 0, sizeof(BN_MONT_CTX)); 132| 1.23k| BN_init(&ret->RR); 133| 1.23k| BN_init(&ret->N); 134| | 135| 1.23k| return ret; 136| 1.23k|} BN_MONT_CTX_free: 138| 3.20k|void BN_MONT_CTX_free(BN_MONT_CTX *mont) { 139| 3.20k| if (mont == NULL) { ------------------ | Branch (139:7): [True: 1.98k, False: 1.22k] ------------------ 140| 1.98k| return; 141| 1.98k| } 142| | 143| 1.22k| BN_free(&mont->RR); 144| 1.22k| BN_free(&mont->N); 145| 1.22k| OPENSSL_free(mont); 146| 1.22k|} BN_MONT_CTX_set: 210| 7|int BN_MONT_CTX_set(BN_MONT_CTX *mont, const BIGNUM *mod, BN_CTX *ctx) { 211| 7| if (!bn_mont_ctx_set_N_and_n0(mont, mod)) { ------------------ | Branch (211:7): [True: 0, False: 7] ------------------ 212| 0| return 0; 213| 0| } 214| | 215| 7| BN_CTX *new_ctx = NULL; 216| 7| if (ctx == NULL) { ------------------ | Branch (216:7): [True: 4, False: 3] ------------------ 217| 4| new_ctx = BN_CTX_new(); 218| 4| if (new_ctx == NULL) { ------------------ | Branch (218:9): [True: 0, False: 4] ------------------ 219| 0| return 0; 220| 0| } 221| 4| ctx = new_ctx; 222| 4| } 223| | 224| | // Save RR = R**2 (mod N). R is the smallest power of 2**BN_BITS2 such that R 225| | // > mod. Even though the assembly on some 32-bit platforms works with 64-bit 226| | // values, using |BN_BITS2| here, rather than |BN_MONT_CTX_N0_LIMBS * 227| | // BN_BITS2|, is correct because R**2 will still be a multiple of the latter 228| | // as |BN_MONT_CTX_N0_LIMBS| is either one or two. 229| 7| unsigned lgBigR = mont->N.width * BN_BITS2; ------------------ | | 151| 7|#define BN_BITS2 64 ------------------ 230| 7| BN_zero(&mont->RR); 231| 7| int ok = BN_set_bit(&mont->RR, lgBigR * 2) && ------------------ | Branch (231:12): [True: 7, False: 0] ------------------ 232| 7| BN_mod(&mont->RR, &mont->RR, &mont->N, ctx) && ------------------ | | 547| 14| BN_div(NULL, (rem), (numerator), (divisor), (ctx)) | | ------------------ | | | Branch (547:3): [True: 7, False: 0] | | ------------------ ------------------ 233| 7| bn_resize_words(&mont->RR, mont->N.width); ------------------ | Branch (233:12): [True: 7, False: 0] ------------------ 234| 7| BN_CTX_free(new_ctx); 235| 7| return ok; 236| 7|} BN_MONT_CTX_new_for_modulus: 238| 7|BN_MONT_CTX *BN_MONT_CTX_new_for_modulus(const BIGNUM *mod, BN_CTX *ctx) { 239| 7| BN_MONT_CTX *mont = BN_MONT_CTX_new(); 240| 7| if (mont == NULL || ------------------ | Branch (240:7): [True: 0, False: 7] ------------------ 241| 7| !BN_MONT_CTX_set(mont, mod, ctx)) { ------------------ | Branch (241:7): [True: 0, False: 7] ------------------ 242| 0| BN_MONT_CTX_free(mont); 243| 0| return NULL; 244| 0| } 245| 7| return mont; 246| 7|} BN_MONT_CTX_new_consttime: 248| 1.22k|BN_MONT_CTX *BN_MONT_CTX_new_consttime(const BIGNUM *mod, BN_CTX *ctx) { 249| 1.22k| BN_MONT_CTX *mont = BN_MONT_CTX_new(); 250| 1.22k| if (mont == NULL || ------------------ | Branch (250:7): [True: 0, False: 1.22k] ------------------ 251| 1.22k| !bn_mont_ctx_set_N_and_n0(mont, mod)) { ------------------ | Branch (251:7): [True: 0, False: 1.22k] ------------------ 252| 0| goto err; 253| 0| } 254| 1.22k| unsigned lgBigR = mont->N.width * BN_BITS2; ------------------ | | 151| 1.22k|#define BN_BITS2 64 ------------------ 255| 1.22k| if (!bn_mod_exp_base_2_consttime(&mont->RR, lgBigR * 2, &mont->N, ctx) || ------------------ | Branch (255:7): [True: 0, False: 1.22k] ------------------ 256| 1.22k| !bn_resize_words(&mont->RR, mont->N.width)) { ------------------ | Branch (256:7): [True: 0, False: 1.22k] ------------------ 257| 0| goto err; 258| 0| } 259| 1.22k| return mont; 260| | 261| 0|err: 262| 0| BN_MONT_CTX_free(mont); 263| 0| return NULL; 264| 1.22k|} BN_to_montgomery: 286| 1.22k| BN_CTX *ctx) { 287| 1.22k| return BN_mod_mul_montgomery(ret, a, &mont->RR, mont, ctx); 288| 1.22k|} BN_from_montgomery: 346| 1.22k| BN_CTX *ctx) { 347| 1.22k| int ret = 0; 348| 1.22k| BIGNUM *t; 349| | 350| 1.22k| BN_CTX_start(ctx); 351| 1.22k| t = BN_CTX_get(ctx); 352| 1.22k| if (t == NULL || ------------------ | Branch (352:7): [True: 0, False: 1.22k] ------------------ 353| 1.22k| !BN_copy(t, a)) { ------------------ | Branch (353:7): [True: 0, False: 1.22k] ------------------ 354| 0| goto err; 355| 0| } 356| | 357| 1.22k| ret = BN_from_montgomery_word(r, t, mont); 358| | 359| 1.22k|err: 360| 1.22k| BN_CTX_end(ctx); 361| | 362| 1.22k| return ret; 363| 1.22k|} BN_mod_mul_montgomery: 420| 222k| const BN_MONT_CTX *mont, BN_CTX *ctx) { 421| 222k| if (a->neg || b->neg) { ------------------ | Branch (421:7): [True: 0, False: 222k] | Branch (421:17): [True: 0, False: 222k] ------------------ 422| 0| OPENSSL_PUT_ERROR(BN, BN_R_NEGATIVE_NUMBER); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 423| 0| return 0; 424| 0| } 425| | 426| 222k|#if defined(OPENSSL_BN_ASM_MONT) 427| | // |bn_mul_mont| requires at least 128 bits of limbs, at least for x86. 428| 222k| int num = mont->N.width; 429| 222k| if (num >= (128 / BN_BITS2) && ------------------ | | 151| 222k|#define BN_BITS2 64 ------------------ | Branch (429:7): [True: 222k, False: 0] ------------------ 430| 222k| a->width == num && ------------------ | Branch (430:7): [True: 222k, False: 555] ------------------ 431| 222k| b->width == num) { ------------------ | Branch (431:7): [True: 222k, False: 0] ------------------ 432| 222k| if (!bn_wexpand(r, num)) { ------------------ | Branch (432:9): [True: 0, False: 222k] ------------------ 433| 0| return 0; 434| 0| } 435| | // This bound is implied by |bn_mont_ctx_set_N_and_n0|. |bn_mul_mont| 436| | // allocates |num| words on the stack, so |num| cannot be too large. 437| 222k| assert((size_t)num <= BN_MONTGOMERY_MAX_WORDS); 438| 222k| if (!bn_mul_mont(r->d, a->d, b->d, mont->N.d, mont->n0, num)) { ------------------ | Branch (438:9): [True: 0, False: 222k] ------------------ 439| | // The check above ensures this won't happen. 440| 0| assert(0); 441| 0| OPENSSL_PUT_ERROR(BN, ERR_R_INTERNAL_ERROR); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 442| 0| return 0; 443| 0| } 444| 222k| r->neg = 0; 445| 222k| r->width = num; 446| 222k| return 1; 447| 222k| } 448| 555|#endif 449| | 450| 555| return bn_mod_mul_montgomery_fallback(r, a, b, mont, ctx); 451| 222k|} bn_to_montgomery_small: 459| 238| const BN_MONT_CTX *mont) { 460| 238| bn_mod_mul_montgomery_small(r, a, mont->RR.d, num, mont); 461| 238|} bn_from_montgomery_small: 464| 458| size_t num_a, const BN_MONT_CTX *mont) { 465| 458| if (num_r != (size_t)mont->N.width || num_r > BN_SMALL_MAX_WORDS || ------------------ | | 684| 916|#define BN_SMALL_MAX_WORDS 9 ------------------ | Branch (465:7): [True: 0, False: 458] | Branch (465:41): [True: 0, False: 458] ------------------ 466| 458| num_a > 2 * num_r) { ------------------ | Branch (466:7): [True: 0, False: 458] ------------------ 467| 0| abort(); 468| 0| } 469| 458| BN_ULONG tmp[BN_SMALL_MAX_WORDS * 2] = {0}; 470| 458| OPENSSL_memcpy(tmp, a, num_a * sizeof(BN_ULONG)); 471| 458| if (!bn_from_montgomery_in_place(r, num_r, tmp, 2 * num_r, mont)) { ------------------ | Branch (471:7): [True: 0, False: 458] ------------------ 472| 0| abort(); 473| 0| } 474| 458| OPENSSL_cleanse(tmp, 2 * num_r * sizeof(BN_ULONG)); 475| 458|} bn_mod_mul_montgomery_small: 479| 22.2k| const BN_MONT_CTX *mont) { 480| 22.2k| if (num != (size_t)mont->N.width || num > BN_SMALL_MAX_WORDS) { ------------------ | | 684| 22.2k|#define BN_SMALL_MAX_WORDS 9 ------------------ | Branch (480:7): [True: 0, False: 22.2k] | Branch (480:39): [True: 0, False: 22.2k] ------------------ 481| 0| abort(); 482| 0| } 483| | 484| 22.2k|#if defined(OPENSSL_BN_ASM_MONT) 485| | // |bn_mul_mont| requires at least 128 bits of limbs, at least for x86. 486| 22.2k| if (num >= (128 / BN_BITS2)) { ------------------ | | 151| 22.2k|#define BN_BITS2 64 ------------------ | Branch (486:7): [True: 22.2k, False: 0] ------------------ 487| 22.2k| if (!bn_mul_mont(r, a, b, mont->N.d, mont->n0, num)) { ------------------ | Branch (487:9): [True: 0, False: 22.2k] ------------------ 488| 0| abort(); // The check above ensures this won't happen. 489| 0| } 490| 22.2k| return; 491| 22.2k| } 492| 0|#endif 493| | 494| | // Compute the product. 495| 0| BN_ULONG tmp[2 * BN_SMALL_MAX_WORDS]; 496| 0| if (a == b) { ------------------ | Branch (496:7): [True: 0, False: 0] ------------------ 497| 0| bn_sqr_small(tmp, 2 * num, a, num); 498| 0| } else { 499| 0| bn_mul_small(tmp, 2 * num, a, num, b, num); 500| 0| } 501| | 502| | // Reduce. 503| 0| if (!bn_from_montgomery_in_place(r, num, tmp, 2 * num, mont)) { ------------------ | Branch (503:7): [True: 0, False: 0] ------------------ 504| 0| abort(); 505| 0| } 506| 0| OPENSSL_cleanse(tmp, 2 * num * sizeof(BN_ULONG)); 507| 0|} bcm.c:bn_mont_ctx_set_N_and_n0: 162| 1.23k|static int bn_mont_ctx_set_N_and_n0(BN_MONT_CTX *mont, const BIGNUM *mod) { 163| 1.23k| if (BN_is_zero(mod)) { ------------------ | Branch (163:7): [True: 0, False: 1.23k] ------------------ 164| 0| OPENSSL_PUT_ERROR(BN, BN_R_DIV_BY_ZERO); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 165| 0| return 0; 166| 0| } 167| 1.23k| if (!BN_is_odd(mod)) { ------------------ | Branch (167:7): [True: 0, False: 1.23k] ------------------ 168| 0| OPENSSL_PUT_ERROR(BN, BN_R_CALLED_WITH_EVEN_MODULUS); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 169| 0| return 0; 170| 0| } 171| 1.23k| if (BN_is_negative(mod)) { ------------------ | Branch (171:7): [True: 0, False: 1.23k] ------------------ 172| 0| OPENSSL_PUT_ERROR(BN, BN_R_NEGATIVE_NUMBER); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 173| 0| return 0; 174| 0| } 175| 1.23k| if (!bn_fits_in_words(mod, BN_MONTGOMERY_MAX_WORDS)) { ------------------ | | 363| 1.23k|#define BN_MONTGOMERY_MAX_WORDS (8 * 1024 / sizeof(BN_ULONG)) ------------------ | Branch (175:7): [True: 0, False: 1.23k] ------------------ 176| 0| OPENSSL_PUT_ERROR(BN, BN_R_BIGNUM_TOO_LONG); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 177| 0| return 0; 178| 0| } 179| | 180| | // Save the modulus. 181| 1.23k| if (!BN_copy(&mont->N, mod)) { ------------------ | Branch (181:7): [True: 0, False: 1.23k] ------------------ 182| 0| OPENSSL_PUT_ERROR(BN, ERR_R_INTERNAL_ERROR); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 183| 0| return 0; 184| 0| } 185| | // |mont->N| is always stored minimally. Computing RR efficiently leaks the 186| | // size of the modulus. While the modulus may be private in RSA (one of the 187| | // primes), their sizes are public, so this is fine. 188| 1.23k| bn_set_minimal_width(&mont->N); 189| | 190| | // Find n0 such that n0 * N == -1 (mod r). 191| | // 192| | // Only certain BN_BITS2<=32 platforms actually make use of n0[1]. For the 193| | // others, we could use a shorter R value and use faster |BN_ULONG|-based 194| | // math instead of |uint64_t|-based math, which would be double-precision. 195| | // However, currently only the assembler files know which is which. 196| 1.23k| static_assert(BN_MONT_CTX_N0_LIMBS == 1 || BN_MONT_CTX_N0_LIMBS == 2, 197| 1.23k| "BN_MONT_CTX_N0_LIMBS value is invalid"); 198| 1.23k| static_assert(sizeof(BN_ULONG) * BN_MONT_CTX_N0_LIMBS == sizeof(uint64_t), 199| 1.23k| "uint64_t is insufficient precision for n0"); 200| 1.23k| uint64_t n0 = bn_mont_n0(&mont->N); 201| 1.23k| mont->n0[0] = (BN_ULONG)n0; 202| |#if BN_MONT_CTX_N0_LIMBS == 2 203| | mont->n0[1] = (BN_ULONG)(n0 >> BN_BITS2); 204| |#else 205| 1.23k| mont->n0[1] = 0; 206| 1.23k|#endif 207| 1.23k| return 1; 208| 1.23k|} bcm.c:BN_from_montgomery_word: 322| 1.77k| const BN_MONT_CTX *mont) { 323| 1.77k| if (r->neg) { ------------------ | Branch (323:7): [True: 0, False: 1.77k] ------------------ 324| 0| OPENSSL_PUT_ERROR(BN, BN_R_NEGATIVE_NUMBER); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 325| 0| return 0; 326| 0| } 327| | 328| 1.77k| const BIGNUM *n = &mont->N; 329| 1.77k| if (n->width == 0) { ------------------ | Branch (329:7): [True: 0, False: 1.77k] ------------------ 330| 0| ret->width = 0; 331| 0| return 1; 332| 0| } 333| | 334| 1.77k| int max = 2 * n->width; // carry is stored separately 335| 1.77k| if (!bn_resize_words(r, max) || ------------------ | Branch (335:7): [True: 0, False: 1.77k] ------------------ 336| 1.77k| !bn_wexpand(ret, n->width)) { ------------------ | Branch (336:7): [True: 0, False: 1.77k] ------------------ 337| 0| return 0; 338| 0| } 339| | 340| 1.77k| ret->width = n->width; 341| 1.77k| ret->neg = 0; 342| 1.77k| return bn_from_montgomery_in_place(ret->d, ret->width, r->d, r->width, mont); 343| 1.77k|} bcm.c:bn_mod_mul_montgomery_fallback: 388| 555| BN_CTX *ctx) { 389| 555| int ret = 0; 390| | 391| 555| BN_CTX_start(ctx); 392| 555| BIGNUM *tmp = BN_CTX_get(ctx); 393| 555| if (tmp == NULL) { ------------------ | Branch (393:7): [True: 0, False: 555] ------------------ 394| 0| goto err; 395| 0| } 396| | 397| 555| if (a == b) { ------------------ | Branch (397:7): [True: 0, False: 555] ------------------ 398| 0| if (!bn_sqr_consttime(tmp, a, ctx)) { ------------------ | Branch (398:9): [True: 0, False: 0] ------------------ 399| 0| goto err; 400| 0| } 401| 555| } else { 402| 555| if (!bn_mul_consttime(tmp, a, b, ctx)) { ------------------ | Branch (402:9): [True: 0, False: 555] ------------------ 403| 0| goto err; 404| 0| } 405| 555| } 406| | 407| | // reduce from aRR to aR 408| 555| if (!BN_from_montgomery_word(r, tmp, mont)) { ------------------ | Branch (408:7): [True: 0, False: 555] ------------------ 409| 0| goto err; 410| 0| } 411| | 412| 555| ret = 1; 413| | 414| 555|err: 415| 555| BN_CTX_end(ctx); 416| 555| return ret; 417| 555|} bcm.c:bn_from_montgomery_in_place: 291| 2.23k| size_t num_a, const BN_MONT_CTX *mont) { 292| 2.23k| const BN_ULONG *n = mont->N.d; 293| 2.23k| size_t num_n = mont->N.width; 294| 2.23k| if (num_r != num_n || num_a != 2 * num_n) { ------------------ | Branch (294:7): [True: 0, False: 2.23k] | Branch (294:25): [True: 0, False: 2.23k] ------------------ 295| 0| OPENSSL_PUT_ERROR(BN, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 296| 0| return 0; 297| 0| } 298| | 299| | // Add multiples of |n| to |r| until R = 2^(nl * BN_BITS2) divides it. On 300| | // input, we had |r| < |n| * R, so now |r| < 2 * |n| * R. Note that |r| 301| | // includes |carry| which is stored separately. 302| 2.23k| BN_ULONG n0 = mont->n0[0]; 303| 2.23k| BN_ULONG carry = 0; 304| 11.8k| for (size_t i = 0; i < num_n; i++) { ------------------ | Branch (304:22): [True: 9.58k, False: 2.23k] ------------------ 305| 9.58k| BN_ULONG v = bn_mul_add_words(a + i, n, num_n, a[i] * n0); 306| 9.58k| v += carry + a[i + num_n]; 307| 9.58k| carry |= (v != a[i + num_n]); 308| 9.58k| carry &= (v <= a[i + num_n]); 309| 9.58k| a[i + num_n] = v; 310| 9.58k| } 311| | 312| | // Shift |num_n| words to divide by R. We have |a| < 2 * |n|. Note that |a| 313| | // includes |carry| which is stored separately. 314| 2.23k| a += num_n; 315| | 316| | // |a| thus requires at most one additional subtraction |n| to be reduced. 317| 2.23k| bn_reduce_once(r, a, carry, n, num_n); 318| 2.23k| return 1; 319| 2.23k|} bn_mont_n0: 33| 1.23k|uint64_t bn_mont_n0(const BIGNUM *n) { 34| | // These conditions are checked by the caller, |BN_MONT_CTX_set| or 35| | // |BN_MONT_CTX_new_consttime|. 36| 1.23k| assert(!BN_is_zero(n)); 37| 1.23k| assert(!BN_is_negative(n)); 38| 1.23k| assert(BN_is_odd(n)); 39| | 40| | // r == 2**(BN_MONT_CTX_N0_LIMBS * BN_BITS2) and LG_LITTLE_R == lg(r). This 41| | // ensures that we can do integer division by |r| by simply ignoring 42| | // |BN_MONT_CTX_N0_LIMBS| limbs. Similarly, we can calculate values modulo 43| | // |r| by just looking at the lowest |BN_MONT_CTX_N0_LIMBS| limbs. This is 44| | // what makes Montgomery multiplication efficient. 45| | // 46| | // As shown in Algorithm 1 of "Fast Prime Field Elliptic Curve Cryptography 47| | // with 256 Bit Primes" by Shay Gueron and Vlad Krasnov, in the loop of a 48| | // multi-limb Montgomery multiplication of |a * b (mod n)|, given the 49| | // unreduced product |t == a * b|, we repeatedly calculate: 50| | // 51| | // t1 := t % r |t1| is |t|'s lowest limb (see previous paragraph). 52| | // t2 := t1*n0*n 53| | // t3 := t + t2 54| | // t := t3 / r copy all limbs of |t3| except the lowest to |t|. 55| | // 56| | // In the last step, it would only make sense to ignore the lowest limb of 57| | // |t3| if it were zero. The middle steps ensure that this is the case: 58| | // 59| | // t3 == 0 (mod r) 60| | // t + t2 == 0 (mod r) 61| | // t + t1*n0*n == 0 (mod r) 62| | // t1*n0*n == -t (mod r) 63| | // t*n0*n == -t (mod r) 64| | // n0*n == -1 (mod r) 65| | // n0 == -1/n (mod r) 66| | // 67| | // Thus, in each iteration of the loop, we multiply by the constant factor 68| | // |n0|, the negative inverse of n (mod r). 69| | 70| | // n_mod_r = n % r. As explained above, this is done by taking the lowest 71| | // |BN_MONT_CTX_N0_LIMBS| limbs of |n|. 72| 1.23k| uint64_t n_mod_r = n->d[0]; 73| |#if BN_MONT_CTX_N0_LIMBS == 2 74| | if (n->width > 1) { 75| | n_mod_r |= (uint64_t)n->d[1] << BN_BITS2; 76| | } 77| |#endif 78| | 79| 1.23k| return bn_neg_inv_mod_r_u64(n_mod_r); 80| 1.23k|} bn_mod_exp_base_2_consttime: 163| 1.22k| BN_CTX *ctx) { 164| 1.22k| assert(!BN_is_zero(n)); 165| 1.22k| assert(!BN_is_negative(n)); 166| 1.22k| assert(BN_is_odd(n)); 167| | 168| 1.22k| BN_zero(r); 169| | 170| 1.22k| unsigned n_bits = BN_num_bits(n); 171| 1.22k| assert(n_bits != 0); 172| 1.22k| assert(p > n_bits); 173| 1.22k| if (n_bits == 1) { ------------------ | Branch (173:7): [True: 0, False: 1.22k] ------------------ 174| 0| return 1; 175| 0| } 176| | 177| | // Set |r| to the larger power of two smaller than |n|, then shift with 178| | // reductions the rest of the way. 179| 1.22k| if (!BN_set_bit(r, n_bits - 1) || ------------------ | Branch (179:7): [True: 0, False: 1.22k] ------------------ 180| 1.22k| !bn_mod_lshift_consttime(r, r, p - (n_bits - 1), n, ctx)) { ------------------ | Branch (180:7): [True: 0, False: 1.22k] ------------------ 181| 0| return 0; 182| 0| } 183| | 184| 1.22k| return 1; 185| 1.22k|} bcm.c:bn_neg_inv_mod_r_u64: 104| 1.23k|static uint64_t bn_neg_inv_mod_r_u64(uint64_t n) { 105| 1.23k| assert(n % 2 == 1); 106| | 107| | // alpha == 2**(lg r - 1) == r / 2. 108| 1.23k| static const uint64_t alpha = UINT64_C(1) << (LG_LITTLE_R - 1); ------------------ | | 31| 1.23k|#define LG_LITTLE_R (BN_MONT_CTX_N0_LIMBS * BN_BITS2) | | ------------------ | | | | 158| 1.23k|#define BN_MONT_CTX_N0_LIMBS 1 | | ------------------ | | #define LG_LITTLE_R (BN_MONT_CTX_N0_LIMBS * BN_BITS2) | | ------------------ | | | | 151| 1.23k|#define BN_BITS2 64 | | ------------------ ------------------ 109| | 110| 1.23k| const uint64_t beta = n; 111| | 112| 1.23k| uint64_t u = 1; 113| 1.23k| uint64_t v = 0; 114| | 115| | // The invariant maintained from here on is: 116| | // 2**(lg r - i) == u*2*alpha - v*beta. 117| 79.9k| for (size_t i = 0; i < LG_LITTLE_R; ++i) { ------------------ | | 31| 79.9k|#define LG_LITTLE_R (BN_MONT_CTX_N0_LIMBS * BN_BITS2) | | ------------------ | | | | 158| 79.9k|#define BN_MONT_CTX_N0_LIMBS 1 | | ------------------ | | #define LG_LITTLE_R (BN_MONT_CTX_N0_LIMBS * BN_BITS2) | | ------------------ | | | | 151| 79.9k|#define BN_BITS2 64 | | ------------------ ------------------ | Branch (117:22): [True: 78.7k, False: 1.23k] ------------------ 118| 78.7k|#if BN_BITS2 == 64 && defined(BN_ULLONG) 119| 78.7k| assert((BN_ULLONG)(1) << (LG_LITTLE_R - i) == 120| 78.7k| ((BN_ULLONG)u * 2 * alpha) - ((BN_ULLONG)v * beta)); 121| 78.7k|#endif 122| | 123| | // Delete a common factor of 2 in u and v if |u| is even. Otherwise, set 124| | // |u = (u + beta) / 2| and |v = (v / 2) + alpha|. 125| | 126| 78.7k| uint64_t u_is_odd = UINT64_C(0) - (u & 1); // Either 0xff..ff or 0. 127| | 128| | // The addition can overflow, so use Dietz's method for it. 129| | // 130| | // Dietz calculates (x+y)/2 by (x⊕y)>>1 + x&y. This is valid for all 131| | // (unsigned) x and y, even when x+y overflows. Evidence for 32-bit values 132| | // (embedded in 64 bits to so that overflow can be ignored): 133| | // 134| | // (declare-fun x () (_ BitVec 64)) 135| | // (declare-fun y () (_ BitVec 64)) 136| | // (assert (let ( 137| | // (one (_ bv1 64)) 138| | // (thirtyTwo (_ bv32 64))) 139| | // (and 140| | // (bvult x (bvshl one thirtyTwo)) 141| | // (bvult y (bvshl one thirtyTwo)) 142| | // (not (= 143| | // (bvadd (bvlshr (bvxor x y) one) (bvand x y)) 144| | // (bvlshr (bvadd x y) one))) 145| | // ))) 146| | // (check-sat) 147| 78.7k| uint64_t beta_if_u_is_odd = beta & u_is_odd; // Either |beta| or 0. 148| 78.7k| u = ((u ^ beta_if_u_is_odd) >> 1) + (u & beta_if_u_is_odd); 149| | 150| 78.7k| uint64_t alpha_if_u_is_odd = alpha & u_is_odd; // Either |alpha| or 0. 151| 78.7k| v = (v >> 1) + alpha_if_u_is_odd; 152| 78.7k| } 153| | 154| | // The invariant now shows that u*r - v*n == 1 since r == 2 * alpha. 155| 1.23k|#if BN_BITS2 == 64 && defined(BN_ULLONG) 156| 1.23k| assert(1 == ((BN_ULLONG)u * 2 * alpha) - ((BN_ULLONG)v * beta)); 157| 1.23k|#endif 158| | 159| 1.23k| return v; 160| 1.23k|} BN_mul: 515| 40.3k|int BN_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx) { 516| 40.3k| if (!bn_mul_impl(r, a, b, ctx)) { ------------------ | Branch (516:7): [True: 0, False: 40.3k] ------------------ 517| 0| return 0; 518| 0| } 519| | 520| | // This additionally fixes any negative zeros created by |bn_mul_impl|. 521| 40.3k| bn_set_minimal_width(r); 522| 40.3k| return 1; 523| 40.3k|} bn_mul_consttime: 525| 555|int bn_mul_consttime(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx) { 526| | // Prevent negative zeros. 527| 555| if (a->neg || b->neg) { ------------------ | Branch (527:7): [True: 0, False: 555] | Branch (527:17): [True: 0, False: 555] ------------------ 528| 0| OPENSSL_PUT_ERROR(BN, BN_R_NEGATIVE_NUMBER); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 529| 0| return 0; 530| 0| } 531| | 532| 555| return bn_mul_impl(r, a, b, ctx); 533| 555|} bn_sqr_consttime: 668| 981k|int bn_sqr_consttime(BIGNUM *r, const BIGNUM *a, BN_CTX *ctx) { 669| 981k| int al = a->width; 670| 981k| if (al <= 0) { ------------------ | Branch (670:7): [True: 0, False: 981k] ------------------ 671| 0| r->width = 0; 672| 0| r->neg = 0; 673| 0| return 1; 674| 0| } 675| | 676| 981k| int ret = 0; 677| 981k| BN_CTX_start(ctx); 678| 981k| BIGNUM *rr = (a != r) ? r : BN_CTX_get(ctx); ------------------ | Branch (678:16): [True: 963k, False: 18.5k] ------------------ 679| 981k| BIGNUM *tmp = BN_CTX_get(ctx); 680| 981k| if (!rr || !tmp) { ------------------ | Branch (680:7): [True: 0, False: 981k] | Branch (680:14): [True: 0, False: 981k] ------------------ 681| 0| goto err; 682| 0| } 683| | 684| 981k| int max = 2 * al; // Non-zero (from above) 685| 981k| if (!bn_wexpand(rr, max)) { ------------------ | Branch (685:7): [True: 0, False: 981k] ------------------ 686| 0| goto err; 687| 0| } 688| | 689| 981k| if (al == 4) { ------------------ | Branch (689:7): [True: 981k, False: 105] ------------------ 690| 981k| bn_sqr_comba4(rr->d, a->d); 691| 981k| } else if (al == 8) { ------------------ | Branch (691:14): [True: 0, False: 105] ------------------ 692| 0| bn_sqr_comba8(rr->d, a->d); 693| 105| } else { 694| 105| if (al < BN_SQR_RECURSIVE_SIZE_NORMAL) { ------------------ | | 71| 105|#define BN_SQR_RECURSIVE_SIZE_NORMAL BN_MUL_RECURSIVE_SIZE_NORMAL | | ------------------ | | | | 70| 105|#define BN_MUL_RECURSIVE_SIZE_NORMAL 16 | | ------------------ ------------------ | Branch (694:9): [True: 105, False: 0] ------------------ 695| 105| BN_ULONG t[BN_SQR_RECURSIVE_SIZE_NORMAL * 2]; 696| 105| bn_sqr_normal(rr->d, a->d, al, t); 697| 105| } else { 698| | // If |al| is a power of two, we can use |bn_sqr_recursive|. 699| 0| if (al != 0 && (al & (al - 1)) == 0) { ------------------ | Branch (699:11): [True: 0, False: 0] | Branch (699:22): [True: 0, False: 0] ------------------ 700| 0| if (!bn_wexpand(tmp, al * 4)) { ------------------ | Branch (700:13): [True: 0, False: 0] ------------------ 701| 0| goto err; 702| 0| } 703| 0| bn_sqr_recursive(rr->d, a->d, al, tmp->d); 704| 0| } else { 705| 0| if (!bn_wexpand(tmp, max)) { ------------------ | Branch (705:13): [True: 0, False: 0] ------------------ 706| 0| goto err; 707| 0| } 708| 0| bn_sqr_normal(rr->d, a->d, al, tmp->d); 709| 0| } 710| 0| } 711| 105| } 712| | 713| 981k| rr->neg = 0; 714| 981k| rr->width = max; 715| | 716| 981k| if (rr != r && !BN_copy(r, rr)) { ------------------ | Branch (716:7): [True: 18.5k, False: 963k] | Branch (716:18): [True: 0, False: 18.5k] ------------------ 717| 0| goto err; 718| 0| } 719| 981k| ret = 1; 720| | 721| 981k|err: 722| 981k| BN_CTX_end(ctx); 723| 981k| return ret; 724| 981k|} BN_sqr: 726| 981k|int BN_sqr(BIGNUM *r, const BIGNUM *a, BN_CTX *ctx) { 727| 981k| if (!bn_sqr_consttime(r, a, ctx)) { ------------------ | Branch (727:7): [True: 0, False: 981k] ------------------ 728| 0| return 0; 729| 0| } 730| | 731| 981k| bn_set_minimal_width(r); 732| 981k| return 1; 733| 981k|} bcm.c:bn_mul_impl: 420| 40.9k| BN_CTX *ctx) { 421| 40.9k| int al = a->width; 422| 40.9k| int bl = b->width; 423| 40.9k| if (al == 0 || bl == 0) { ------------------ | Branch (423:7): [True: 2, False: 40.9k] | Branch (423:18): [True: 0, False: 40.9k] ------------------ 424| 2| BN_zero(r); 425| 2| return 1; 426| 2| } 427| | 428| 40.9k| int ret = 0; 429| 40.9k| BIGNUM *rr; 430| 40.9k| BN_CTX_start(ctx); 431| 40.9k| if (r == a || r == b) { ------------------ | Branch (431:7): [True: 0, False: 40.9k] | Branch (431:17): [True: 0, False: 40.9k] ------------------ 432| 0| rr = BN_CTX_get(ctx); 433| 0| if (rr == NULL) { ------------------ | Branch (433:9): [True: 0, False: 0] ------------------ 434| 0| goto err; 435| 0| } 436| 40.9k| } else { 437| 40.9k| rr = r; 438| 40.9k| } 439| 40.9k| rr->neg = a->neg ^ b->neg; 440| | 441| 40.9k| int i = al - bl; 442| 40.9k| if (i == 0) { ------------------ | Branch (442:7): [True: 40.2k, False: 682] ------------------ 443| 40.2k| if (al == 8) { ------------------ | Branch (443:9): [True: 0, False: 40.2k] ------------------ 444| 0| if (!bn_wexpand(rr, 16)) { ------------------ | Branch (444:11): [True: 0, False: 0] ------------------ 445| 0| goto err; 446| 0| } 447| 0| rr->width = 16; 448| 0| bn_mul_comba8(rr->d, a->d, b->d); 449| 0| goto end; 450| 0| } 451| 40.2k| } 452| | 453| 40.9k| int top = al + bl; 454| 40.9k| static const int kMulNormalSize = 16; 455| 40.9k| if (al >= kMulNormalSize && bl >= kMulNormalSize) { ------------------ | Branch (455:7): [True: 0, False: 40.9k] | Branch (455:31): [True: 0, False: 0] ------------------ 456| 0| if (-1 <= i && i <= 1) { ------------------ | Branch (456:9): [True: 0, False: 0] | Branch (456:20): [True: 0, False: 0] ------------------ 457| | // Find the largest power of two less than or equal to the larger length. 458| 0| int j; 459| 0| if (i >= 0) { ------------------ | Branch (459:11): [True: 0, False: 0] ------------------ 460| 0| j = BN_num_bits_word((BN_ULONG)al); 461| 0| } else { 462| 0| j = BN_num_bits_word((BN_ULONG)bl); 463| 0| } 464| 0| j = 1 << (j - 1); 465| 0| assert(j <= al || j <= bl); 466| 0| BIGNUM *t = BN_CTX_get(ctx); 467| 0| if (t == NULL) { ------------------ | Branch (467:11): [True: 0, False: 0] ------------------ 468| 0| goto err; 469| 0| } 470| 0| if (al > j || bl > j) { ------------------ | Branch (470:11): [True: 0, False: 0] | Branch (470:21): [True: 0, False: 0] ------------------ 471| | // We know |al| and |bl| are at most one from each other, so if al > j, 472| | // bl >= j, and vice versa. Thus we can use |bn_mul_part_recursive|. 473| | // 474| | // TODO(davidben): This codepath is almost unused in standard 475| | // algorithms. Is this optimization necessary? See notes in 476| | // https://boringssl-review.googlesource.com/q/I0bd604e2cd6a75c266f64476c23a730ca1721ea6 477| 0| assert(al >= j && bl >= j); 478| 0| if (!bn_wexpand(t, j * 8) || ------------------ | Branch (478:13): [True: 0, False: 0] ------------------ 479| 0| !bn_wexpand(rr, j * 4)) { ------------------ | Branch (479:13): [True: 0, False: 0] ------------------ 480| 0| goto err; 481| 0| } 482| 0| bn_mul_part_recursive(rr->d, a->d, b->d, j, al - j, bl - j, t->d); 483| 0| } else { 484| | // al <= j && bl <= j. Additionally, we know j <= al or j <= bl, so one 485| | // of al - j or bl - j is zero. The other, by the bound on |i| above, is 486| | // zero or -1. Thus, we can use |bn_mul_recursive|. 487| 0| if (!bn_wexpand(t, j * 4) || ------------------ | Branch (487:13): [True: 0, False: 0] ------------------ 488| 0| !bn_wexpand(rr, j * 2)) { ------------------ | Branch (488:13): [True: 0, False: 0] ------------------ 489| 0| goto err; 490| 0| } 491| 0| bn_mul_recursive(rr->d, a->d, b->d, j, al - j, bl - j, t->d); 492| 0| } 493| 0| rr->width = top; 494| 0| goto end; 495| 0| } 496| 0| } 497| | 498| 40.9k| if (!bn_wexpand(rr, top)) { ------------------ | Branch (498:7): [True: 0, False: 40.9k] ------------------ 499| 0| goto err; 500| 0| } 501| 40.9k| rr->width = top; 502| 40.9k| bn_mul_normal(rr->d, a->d, al, b->d, bl); 503| | 504| 40.9k|end: 505| 40.9k| if (r != rr && !BN_copy(r, rr)) { ------------------ | Branch (505:7): [True: 0, False: 40.9k] | Branch (505:18): [True: 0, False: 0] ------------------ 506| 0| goto err; 507| 0| } 508| 40.9k| ret = 1; 509| | 510| 40.9k|err: 511| 40.9k| BN_CTX_end(ctx); 512| 40.9k| return ret; 513| 40.9k|} bcm.c:bn_mul_normal: 82| 40.9k| const BN_ULONG *b, size_t nb) { 83| 40.9k| if (na < nb) { ------------------ | Branch (83:7): [True: 678, False: 40.2k] ------------------ 84| 678| size_t itmp = na; 85| 678| na = nb; 86| 678| nb = itmp; 87| 678| const BN_ULONG *ltmp = a; 88| 678| a = b; 89| 678| b = ltmp; 90| 678| } 91| 40.9k| BN_ULONG *rr = &(r[na]); 92| 40.9k| if (nb == 0) { ------------------ | Branch (92:7): [True: 0, False: 40.9k] ------------------ 93| 0| OPENSSL_memset(r, 0, na * sizeof(BN_ULONG)); 94| 0| return; 95| 0| } 96| 40.9k| rr[0] = bn_mul_words(r, a, na, b[0]); 97| | 98| 40.9k| for (;;) { 99| 40.9k| if (--nb == 0) { ------------------ | Branch (99:9): [True: 570, False: 40.4k] ------------------ 100| 570| return; 101| 570| } 102| 40.4k| rr[1] = bn_mul_add_words(&(r[1]), a, na, b[1]); 103| 40.4k| if (--nb == 0) { ------------------ | Branch (103:9): [True: 82, False: 40.3k] ------------------ 104| 82| return; 105| 82| } 106| 40.3k| rr[2] = bn_mul_add_words(&(r[2]), a, na, b[2]); 107| 40.3k| if (--nb == 0) { ------------------ | Branch (107:9): [True: 63, False: 40.2k] ------------------ 108| 63| return; 109| 63| } 110| 40.2k| rr[3] = bn_mul_add_words(&(r[3]), a, na, b[3]); 111| 40.2k| if (--nb == 0) { ------------------ | Branch (111:9): [True: 40.2k, False: 48] ------------------ 112| 40.2k| return; 113| 40.2k| } 114| 48| rr[4] = bn_mul_add_words(&(r[4]), a, na, b[4]); 115| 48| rr += 4; 116| 48| r += 4; 117| 48| b += 4; 118| 48| } 119| 40.9k|} bcm.c:bn_sqr_normal: 551| 105| BN_ULONG *tmp) { 552| 105| if (n == 0) { ------------------ | Branch (552:7): [True: 0, False: 105] ------------------ 553| 0| return; 554| 0| } 555| | 556| 105| size_t max = n * 2; 557| 105| const BN_ULONG *ap = a; 558| 105| BN_ULONG *rp = r; 559| 105| rp[0] = rp[max - 1] = 0; 560| 105| rp++; 561| | 562| | // Compute the contribution of a[i] * a[j] for all i < j. 563| 105| if (n > 1) { ------------------ | Branch (563:7): [True: 105, False: 0] ------------------ 564| 105| ap++; 565| 105| rp[n - 1] = bn_mul_words(rp, ap, n - 1, ap[-1]); 566| 105| rp += 2; 567| 105| } 568| 105| if (n > 2) { ------------------ | Branch (568:7): [True: 105, False: 0] ------------------ 569| 576| for (size_t i = n - 2; i > 0; i--) { ------------------ | Branch (569:28): [True: 471, False: 105] ------------------ 570| 471| ap++; 571| 471| rp[i] = bn_mul_add_words(rp, ap, i, ap[-1]); 572| 471| rp += 2; 573| 471| } 574| 105| } 575| | 576| | // The final result fits in |max| words, so none of the following operations 577| | // will overflow. 578| | 579| | // Double |r|, giving the contribution of a[i] * a[j] for all i != j. 580| 105| bn_add_words(r, r, r, max); 581| | 582| | // Add in the contribution of a[i] * a[i] for all i. 583| 105| bn_sqr_words(tmp, a, n); 584| 105| bn_add_words(r, r, tmp, max); 585| 105|} BN_lshift: 67| 2.06M|int BN_lshift(BIGNUM *r, const BIGNUM *a, int n) { 68| 2.06M| int i, nw, lb, rb; 69| 2.06M| BN_ULONG *t, *f; 70| 2.06M| BN_ULONG l; 71| | 72| 2.06M| if (n < 0) { ------------------ | Branch (72:7): [True: 0, False: 2.06M] ------------------ 73| 0| OPENSSL_PUT_ERROR(BN, BN_R_NEGATIVE_NUMBER); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 74| 0| return 0; 75| 0| } 76| | 77| 2.06M| r->neg = a->neg; 78| 2.06M| nw = n / BN_BITS2; ------------------ | | 151| 2.06M|#define BN_BITS2 64 ------------------ 79| 2.06M| if (!bn_wexpand(r, a->width + nw + 1)) { ------------------ | Branch (79:7): [True: 0, False: 2.06M] ------------------ 80| 0| return 0; 81| 0| } 82| 2.06M| lb = n % BN_BITS2; ------------------ | | 151| 2.06M|#define BN_BITS2 64 ------------------ 83| 2.06M| rb = BN_BITS2 - lb; ------------------ | | 151| 2.06M|#define BN_BITS2 64 ------------------ 84| 2.06M| f = a->d; 85| 2.06M| t = r->d; 86| 2.06M| t[a->width + nw] = 0; 87| 2.06M| if (lb == 0) { ------------------ | Branch (87:7): [True: 864, False: 2.06M] ------------------ 88| 6.23k| for (i = a->width - 1; i >= 0; i--) { ------------------ | Branch (88:28): [True: 5.37k, False: 864] ------------------ 89| 5.37k| t[nw + i] = f[i]; 90| 5.37k| } 91| 2.06M| } else { 92| 13.3M| for (i = a->width - 1; i >= 0; i--) { ------------------ | Branch (92:28): [True: 11.2M, False: 2.06M] ------------------ 93| 11.2M| l = f[i]; 94| 11.2M| t[nw + i + 1] |= l >> rb; 95| 11.2M| t[nw + i] = l << lb; 96| 11.2M| } 97| 2.06M| } 98| 2.06M| OPENSSL_memset(t, 0, nw * sizeof(t[0])); 99| 2.06M| r->width = a->width + nw + 1; 100| 2.06M| bn_set_minimal_width(r); 101| | 102| 2.06M| return 1; 103| 2.06M|} bn_rshift_words: 137| 1.04M| size_t num) { 138| 1.04M| unsigned shift_bits = shift % BN_BITS2; ------------------ | | 151| 1.04M|#define BN_BITS2 64 ------------------ 139| 1.04M| size_t shift_words = shift / BN_BITS2; ------------------ | | 151| 1.04M|#define BN_BITS2 64 ------------------ 140| 1.04M| if (shift_words >= num) { ------------------ | Branch (140:7): [True: 5.52k, False: 1.03M] ------------------ 141| 5.52k| OPENSSL_memset(r, 0, num * sizeof(BN_ULONG)); 142| 5.52k| return; 143| 5.52k| } 144| 1.03M| if (shift_bits == 0) { ------------------ | Branch (144:7): [True: 5.39k, False: 1.03M] ------------------ 145| 5.39k| OPENSSL_memmove(r, a + shift_words, (num - shift_words) * sizeof(BN_ULONG)); 146| 1.03M| } else { 147| 4.04M| for (size_t i = shift_words; i < num - 1; i++) { ------------------ | Branch (147:34): [True: 3.00M, False: 1.03M] ------------------ 148| 3.00M| r[i - shift_words] = 149| 3.00M| (a[i] >> shift_bits) | (a[i + 1] << (BN_BITS2 - shift_bits)); ------------------ | | 151| 3.00M|#define BN_BITS2 64 ------------------ 150| 3.00M| } 151| 1.03M| r[num - 1 - shift_words] = a[num - 1] >> shift_bits; 152| 1.03M| } 153| 1.03M| OPENSSL_memset(r + num - shift_words, 0, shift_words * sizeof(BN_ULONG)); 154| 1.03M|} BN_rshift: 156| 1.04M|int BN_rshift(BIGNUM *r, const BIGNUM *a, int n) { 157| 1.04M| if (n < 0) { ------------------ | Branch (157:7): [True: 0, False: 1.04M] ------------------ 158| 0| OPENSSL_PUT_ERROR(BN, BN_R_NEGATIVE_NUMBER); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 159| 0| return 0; 160| 0| } 161| | 162| 1.04M| if (!bn_wexpand(r, a->width)) { ------------------ | Branch (162:7): [True: 0, False: 1.04M] ------------------ 163| 0| return 0; 164| 0| } 165| 1.04M| bn_rshift_words(r->d, a->d, n, a->width); 166| 1.04M| r->neg = a->neg; 167| 1.04M| r->width = a->width; 168| 1.04M| bn_set_minimal_width(r); 169| 1.04M| return 1; 170| 1.04M|} bn_rshift1_words: 200| 552|void bn_rshift1_words(BN_ULONG *r, const BN_ULONG *a, size_t num) { 201| 552| if (num == 0) { ------------------ | Branch (201:7): [True: 0, False: 552] ------------------ 202| 0| return; 203| 0| } 204| 1.10k| for (size_t i = 0; i < num - 1; i++) { ------------------ | Branch (204:22): [True: 552, False: 552] ------------------ 205| 552| r[i] = (a[i] >> 1) | (a[i + 1] << (BN_BITS2 - 1)); ------------------ | | 151| 552|#define BN_BITS2 64 ------------------ 206| 552| } 207| 552| r[num - 1] = a[num - 1] >> 1; 208| 552|} BN_rshift1: 210| 552|int BN_rshift1(BIGNUM *r, const BIGNUM *a) { 211| 552| if (!bn_wexpand(r, a->width)) { ------------------ | Branch (211:7): [True: 0, False: 552] ------------------ 212| 0| return 0; 213| 0| } 214| 552| bn_rshift1_words(r->d, a->d, a->width); 215| 552| r->width = a->width; 216| 552| r->neg = a->neg; 217| 552| bn_set_minimal_width(r); 218| 552| return 1; 219| 552|} BN_set_bit: 221| 1.23k|int BN_set_bit(BIGNUM *a, int n) { 222| 1.23k| if (n < 0) { ------------------ | Branch (222:7): [True: 0, False: 1.23k] ------------------ 223| 0| return 0; 224| 0| } 225| | 226| 1.23k| int i = n / BN_BITS2; ------------------ | | 151| 1.23k|#define BN_BITS2 64 ------------------ 227| 1.23k| int j = n % BN_BITS2; ------------------ | | 151| 1.23k|#define BN_BITS2 64 ------------------ 228| 1.23k| if (a->width <= i) { ------------------ | Branch (228:7): [True: 1.23k, False: 0] ------------------ 229| 1.23k| if (!bn_wexpand(a, i + 1)) { ------------------ | Branch (229:9): [True: 0, False: 1.23k] ------------------ 230| 0| return 0; 231| 0| } 232| 6.34k| for (int k = a->width; k < i + 1; k++) { ------------------ | Branch (232:28): [True: 5.11k, False: 1.23k] ------------------ 233| 5.11k| a->d[k] = 0; 234| 5.11k| } 235| 1.23k| a->width = i + 1; 236| 1.23k| } 237| | 238| 1.23k| a->d[i] |= (((BN_ULONG)1) << j); 239| | 240| 1.23k| return 1; 241| 1.23k|} bn_is_bit_set_words: 261| 268k|int bn_is_bit_set_words(const BN_ULONG *a, size_t num, size_t bit) { 262| 268k| size_t i = bit / BN_BITS2; ------------------ | | 151| 268k|#define BN_BITS2 64 ------------------ 263| 268k| size_t j = bit % BN_BITS2; ------------------ | | 151| 268k|#define BN_BITS2 64 ------------------ 264| 268k| if (i >= num) { ------------------ | Branch (264:7): [True: 0, False: 268k] ------------------ 265| 0| return 0; 266| 0| } 267| 268k| return (a[i] >> j) & 1; 268| 268k|} BN_is_bit_set: 270| 250k|int BN_is_bit_set(const BIGNUM *a, int n) { 271| 250k| if (n < 0) { ------------------ | Branch (271:7): [True: 0, False: 250k] ------------------ 272| 0| return 0; 273| 0| } 274| 250k| return bn_is_bit_set_words(a->d, a->width, n); 275| 250k|} BN_mod_sqrt: 62| 671|BIGNUM *BN_mod_sqrt(BIGNUM *in, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx) { 63| | // Compute a square root of |a| mod |p| using the Tonelli/Shanks algorithm 64| | // (cf. Henri Cohen, "A Course in Algebraic Computational Number Theory", 65| | // algorithm 1.5.1). |p| is assumed to be a prime. 66| | 67| 671| BIGNUM *ret = in; 68| 671| int err = 1; 69| 671| int r; 70| 671| BIGNUM *A, *b, *q, *t, *x, *y; 71| 671| int e, i, j; 72| | 73| 671| if (!BN_is_odd(p) || BN_abs_is_word(p, 1)) { ------------------ | Branch (73:7): [True: 0, False: 671] | Branch (73:24): [True: 0, False: 671] ------------------ 74| 0| if (BN_abs_is_word(p, 2)) { ------------------ | Branch (74:9): [True: 0, False: 0] ------------------ 75| 0| if (ret == NULL) { ------------------ | Branch (75:11): [True: 0, False: 0] ------------------ 76| 0| ret = BN_new(); 77| 0| } 78| 0| if (ret == NULL || ------------------ | Branch (78:11): [True: 0, False: 0] ------------------ 79| 0| !BN_set_word(ret, BN_is_bit_set(a, 0))) { ------------------ | Branch (79:11): [True: 0, False: 0] ------------------ 80| 0| if (ret != in) { ------------------ | Branch (80:13): [True: 0, False: 0] ------------------ 81| 0| BN_free(ret); 82| 0| } 83| 0| return NULL; 84| 0| } 85| 0| return ret; 86| 0| } 87| | 88| 0| OPENSSL_PUT_ERROR(BN, BN_R_P_IS_NOT_PRIME); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 89| 0| return NULL; 90| 0| } 91| | 92| 671| if (BN_is_zero(a) || BN_is_one(a)) { ------------------ | Branch (92:7): [True: 0, False: 671] | Branch (92:24): [True: 0, False: 671] ------------------ 93| 0| if (ret == NULL) { ------------------ | Branch (93:9): [True: 0, False: 0] ------------------ 94| 0| ret = BN_new(); 95| 0| } 96| 0| if (ret == NULL || ------------------ | Branch (96:9): [True: 0, False: 0] ------------------ 97| 0| !BN_set_word(ret, BN_is_one(a))) { ------------------ | Branch (97:9): [True: 0, False: 0] ------------------ 98| 0| if (ret != in) { ------------------ | Branch (98:11): [True: 0, False: 0] ------------------ 99| 0| BN_free(ret); 100| 0| } 101| 0| return NULL; 102| 0| } 103| 0| return ret; 104| 0| } 105| | 106| 671| BN_CTX_start(ctx); 107| 671| A = BN_CTX_get(ctx); 108| 671| b = BN_CTX_get(ctx); 109| 671| q = BN_CTX_get(ctx); 110| 671| t = BN_CTX_get(ctx); 111| 671| x = BN_CTX_get(ctx); 112| 671| y = BN_CTX_get(ctx); 113| 671| if (y == NULL) { ------------------ | Branch (113:7): [True: 0, False: 671] ------------------ 114| 0| goto end; 115| 0| } 116| | 117| 671| if (ret == NULL) { ------------------ | Branch (117:7): [True: 0, False: 671] ------------------ 118| 0| ret = BN_new(); 119| 0| } 120| 671| if (ret == NULL) { ------------------ | Branch (120:7): [True: 0, False: 671] ------------------ 121| 0| goto end; 122| 0| } 123| | 124| | // A = a mod p 125| 671| if (!BN_nnmod(A, a, p, ctx)) { ------------------ | Branch (125:7): [True: 0, False: 671] ------------------ 126| 0| goto end; 127| 0| } 128| | 129| | // now write |p| - 1 as 2^e*q where q is odd 130| 671| e = 1; 131| 53.1k| while (!BN_is_bit_set(p, e)) { ------------------ | Branch (131:10): [True: 52.4k, False: 671] ------------------ 132| 52.4k| e++; 133| 52.4k| } 134| | // we'll set q later (if needed) 135| | 136| 671| if (e == 1) { ------------------ | Branch (136:7): [True: 119, False: 552] ------------------ 137| | // The easy case: (|p|-1)/2 is odd, so 2 has an inverse 138| | // modulo (|p|-1)/2, and square roots can be computed 139| | // directly by modular exponentiation. 140| | // We have 141| | // 2 * (|p|+1)/4 == 1 (mod (|p|-1)/2), 142| | // so we can use exponent (|p|+1)/4, i.e. (|p|-3)/4 + 1. 143| 119| if (!BN_rshift(q, p, 2)) { ------------------ | Branch (143:9): [True: 0, False: 119] ------------------ 144| 0| goto end; 145| 0| } 146| 119| q->neg = 0; 147| 119| if (!BN_add_word(q, 1) || ------------------ | Branch (147:9): [True: 0, False: 119] ------------------ 148| 119| !BN_mod_exp_mont(ret, A, q, p, ctx, NULL)) { ------------------ | Branch (148:9): [True: 0, False: 119] ------------------ 149| 0| goto end; 150| 0| } 151| 119| err = 0; 152| 119| goto vrfy; 153| 119| } 154| | 155| 552| if (e == 2) { ------------------ | Branch (155:7): [True: 0, False: 552] ------------------ 156| | // |p| == 5 (mod 8) 157| | // 158| | // In this case 2 is always a non-square since 159| | // Legendre(2,p) = (-1)^((p^2-1)/8) for any odd prime. 160| | // So if a really is a square, then 2*a is a non-square. 161| | // Thus for 162| | // b := (2*a)^((|p|-5)/8), 163| | // i := (2*a)*b^2 164| | // we have 165| | // i^2 = (2*a)^((1 + (|p|-5)/4)*2) 166| | // = (2*a)^((p-1)/2) 167| | // = -1; 168| | // so if we set 169| | // x := a*b*(i-1), 170| | // then 171| | // x^2 = a^2 * b^2 * (i^2 - 2*i + 1) 172| | // = a^2 * b^2 * (-2*i) 173| | // = a*(-i)*(2*a*b^2) 174| | // = a*(-i)*i 175| | // = a. 176| | // 177| | // (This is due to A.O.L. Atkin, 178| | // , 180| | // November 1992.) 181| | 182| | // t := 2*a 183| 0| if (!bn_mod_lshift1_consttime(t, A, p, ctx)) { ------------------ | Branch (183:9): [True: 0, False: 0] ------------------ 184| 0| goto end; 185| 0| } 186| | 187| | // b := (2*a)^((|p|-5)/8) 188| 0| if (!BN_rshift(q, p, 3)) { ------------------ | Branch (188:9): [True: 0, False: 0] ------------------ 189| 0| goto end; 190| 0| } 191| 0| q->neg = 0; 192| 0| if (!BN_mod_exp_mont(b, t, q, p, ctx, NULL)) { ------------------ | Branch (192:9): [True: 0, False: 0] ------------------ 193| 0| goto end; 194| 0| } 195| | 196| | // y := b^2 197| 0| if (!BN_mod_sqr(y, b, p, ctx)) { ------------------ | Branch (197:9): [True: 0, False: 0] ------------------ 198| 0| goto end; 199| 0| } 200| | 201| | // t := (2*a)*b^2 - 1 202| 0| if (!BN_mod_mul(t, t, y, p, ctx) || ------------------ | Branch (202:9): [True: 0, False: 0] ------------------ 203| 0| !BN_sub_word(t, 1)) { ------------------ | Branch (203:9): [True: 0, False: 0] ------------------ 204| 0| goto end; 205| 0| } 206| | 207| | // x = a*b*t 208| 0| if (!BN_mod_mul(x, A, b, p, ctx) || ------------------ | Branch (208:9): [True: 0, False: 0] ------------------ 209| 0| !BN_mod_mul(x, x, t, p, ctx)) { ------------------ | Branch (209:9): [True: 0, False: 0] ------------------ 210| 0| goto end; 211| 0| } 212| | 213| 0| if (!BN_copy(ret, x)) { ------------------ | Branch (213:9): [True: 0, False: 0] ------------------ 214| 0| goto end; 215| 0| } 216| 0| err = 0; 217| 0| goto vrfy; 218| 0| } 219| | 220| | // e > 2, so we really have to use the Tonelli/Shanks algorithm. 221| | // First, find some y that is not a square. 222| 552| if (!BN_copy(q, p)) { ------------------ | Branch (222:7): [True: 0, False: 552] ------------------ 223| 0| goto end; // use 'q' as temp 224| 0| } 225| 552| q->neg = 0; 226| 552| i = 2; 227| 5.52k| do { 228| | // For efficiency, try small numbers first; 229| | // if this fails, try random numbers. 230| 5.52k| if (i < 22) { ------------------ | Branch (230:9): [True: 5.52k, False: 0] ------------------ 231| 5.52k| if (!BN_set_word(y, i)) { ------------------ | Branch (231:11): [True: 0, False: 5.52k] ------------------ 232| 0| goto end; 233| 0| } 234| 5.52k| } else { 235| 0| if (!BN_pseudo_rand(y, BN_num_bits(p), 0, 0)) { ------------------ | Branch (235:11): [True: 0, False: 0] ------------------ 236| 0| goto end; 237| 0| } 238| 0| if (BN_ucmp(y, p) >= 0) { ------------------ | Branch (238:11): [True: 0, False: 0] ------------------ 239| 0| if (!(p->neg ? BN_add : BN_sub)(y, y, p)) { ------------------ | Branch (239:13): [True: 0, False: 0] | Branch (239:15): [True: 0, False: 0] ------------------ 240| 0| goto end; 241| 0| } 242| 0| } 243| | // now 0 <= y < |p| 244| 0| if (BN_is_zero(y)) { ------------------ | Branch (244:11): [True: 0, False: 0] ------------------ 245| 0| if (!BN_set_word(y, i)) { ------------------ | Branch (245:13): [True: 0, False: 0] ------------------ 246| 0| goto end; 247| 0| } 248| 0| } 249| 0| } 250| | 251| 5.52k| r = bn_jacobi(y, q, ctx); // here 'q' is |p| 252| 5.52k| if (r < -1) { ------------------ | Branch (252:9): [True: 0, False: 5.52k] ------------------ 253| 0| goto end; 254| 0| } 255| 5.52k| if (r == 0) { ------------------ | Branch (255:9): [True: 0, False: 5.52k] ------------------ 256| | // m divides p 257| 0| OPENSSL_PUT_ERROR(BN, BN_R_P_IS_NOT_PRIME); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 258| 0| goto end; 259| 0| } 260| 5.52k| } while (r == 1 && ++i < 82); ------------------ | Branch (260:12): [True: 4.96k, False: 552] | Branch (260:22): [True: 4.96k, False: 0] ------------------ 261| | 262| 552| if (r != -1) { ------------------ | Branch (262:7): [True: 0, False: 552] ------------------ 263| | // Many rounds and still no non-square -- this is more likely 264| | // a bug than just bad luck. 265| | // Even if p is not prime, we should have found some y 266| | // such that r == -1. 267| 0| OPENSSL_PUT_ERROR(BN, BN_R_TOO_MANY_ITERATIONS); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 268| 0| goto end; 269| 0| } 270| | 271| | // Here's our actual 'q': 272| 552| if (!BN_rshift(q, q, e)) { ------------------ | Branch (272:7): [True: 0, False: 552] ------------------ 273| 0| goto end; 274| 0| } 275| | 276| | // Now that we have some non-square, we can find an element 277| | // of order 2^e by computing its q'th power. 278| 552| if (!BN_mod_exp_mont(y, y, q, p, ctx, NULL)) { ------------------ | Branch (278:7): [True: 0, False: 552] ------------------ 279| 0| goto end; 280| 0| } 281| 552| if (BN_is_one(y)) { ------------------ | Branch (281:7): [True: 0, False: 552] ------------------ 282| 0| OPENSSL_PUT_ERROR(BN, BN_R_P_IS_NOT_PRIME); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 283| 0| goto end; 284| 0| } 285| | 286| | // Now we know that (if p is indeed prime) there is an integer 287| | // k, 0 <= k < 2^e, such that 288| | // 289| | // a^q * y^k == 1 (mod p). 290| | // 291| | // As a^q is a square and y is not, k must be even. 292| | // q+1 is even, too, so there is an element 293| | // 294| | // X := a^((q+1)/2) * y^(k/2), 295| | // 296| | // and it satisfies 297| | // 298| | // X^2 = a^q * a * y^k 299| | // = a, 300| | // 301| | // so it is the square root that we are looking for. 302| | 303| | // t := (q-1)/2 (note that q is odd) 304| 552| if (!BN_rshift1(t, q)) { ------------------ | Branch (304:7): [True: 0, False: 552] ------------------ 305| 0| goto end; 306| 0| } 307| | 308| | // x := a^((q-1)/2) 309| 552| if (BN_is_zero(t)) { // special case: p = 2^e + 1 ------------------ | Branch (309:7): [True: 0, False: 552] ------------------ 310| 0| if (!BN_nnmod(t, A, p, ctx)) { ------------------ | Branch (310:9): [True: 0, False: 0] ------------------ 311| 0| goto end; 312| 0| } 313| 0| if (BN_is_zero(t)) { ------------------ | Branch (313:9): [True: 0, False: 0] ------------------ 314| | // special case: a == 0 (mod p) 315| 0| BN_zero(ret); 316| 0| err = 0; 317| 0| goto end; 318| 0| } else if (!BN_one(x)) { ------------------ | Branch (318:16): [True: 0, False: 0] ------------------ 319| 0| goto end; 320| 0| } 321| 552| } else { 322| 552| if (!BN_mod_exp_mont(x, A, t, p, ctx, NULL)) { ------------------ | Branch (322:9): [True: 0, False: 552] ------------------ 323| 0| goto end; 324| 0| } 325| 552| if (BN_is_zero(x)) { ------------------ | Branch (325:9): [True: 0, False: 552] ------------------ 326| | // special case: a == 0 (mod p) 327| 0| BN_zero(ret); 328| 0| err = 0; 329| 0| goto end; 330| 0| } 331| 552| } 332| | 333| | // b := a*x^2 (= a^q) 334| 552| if (!BN_mod_sqr(b, x, p, ctx) || ------------------ | Branch (334:7): [True: 0, False: 552] ------------------ 335| 552| !BN_mod_mul(b, b, A, p, ctx)) { ------------------ | Branch (335:7): [True: 0, False: 552] ------------------ 336| 0| goto end; 337| 0| } 338| | 339| | // x := a*x (= a^((q+1)/2)) 340| 552| if (!BN_mod_mul(x, x, A, p, ctx)) { ------------------ | Branch (340:7): [True: 0, False: 552] ------------------ 341| 0| goto end; 342| 0| } 343| | 344| 19.8k| while (1) { ------------------ | Branch (344:10): [Folded - Ignored] ------------------ 345| | // Now b is a^q * y^k for some even k (0 <= k < 2^E 346| | // where E refers to the original value of e, which we 347| | // don't keep in a variable), and x is a^((q+1)/2) * y^(k/2). 348| | // 349| | // We have a*b = x^2, 350| | // y^2^(e-1) = -1, 351| | // b^2^(e-1) = 1. 352| 19.8k| if (BN_is_one(b)) { ------------------ | Branch (352:9): [True: 403, False: 19.4k] ------------------ 353| 403| if (!BN_copy(ret, x)) { ------------------ | Branch (353:11): [True: 0, False: 403] ------------------ 354| 0| goto end; 355| 0| } 356| 403| err = 0; 357| 403| goto vrfy; 358| 403| } 359| | 360| | // Find the smallest i, 0 < i < e, such that b^(2^i) = 1 361| 942k| for (i = 1; i < e; i++) { ------------------ | Branch (361:17): [True: 942k, False: 149] ------------------ 362| 942k| if (i == 1) { ------------------ | Branch (362:11): [True: 19.4k, False: 922k] ------------------ 363| 19.4k| if (!BN_mod_sqr(t, b, p, ctx)) { ------------------ | Branch (363:13): [True: 0, False: 19.4k] ------------------ 364| 0| goto end; 365| 0| } 366| 922k| } else { 367| 922k| if (!BN_mod_mul(t, t, t, p, ctx)) { ------------------ | Branch (367:13): [True: 0, False: 922k] ------------------ 368| 0| goto end; 369| 0| } 370| 922k| } 371| 942k| if (BN_is_one(t)) { ------------------ | Branch (371:11): [True: 19.3k, False: 922k] ------------------ 372| 19.3k| break; 373| 19.3k| } 374| 942k| } 375| | // If not found, a is not a square or p is not a prime. 376| 19.4k| if (i >= e) { ------------------ | Branch (376:9): [True: 149, False: 19.3k] ------------------ 377| 149| OPENSSL_PUT_ERROR(BN, BN_R_NOT_A_SQUARE); ------------------ | | 441| 149| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 378| 149| goto end; 379| 149| } 380| | 381| | // t := y^2^(e - i - 1) 382| 19.3k| if (!BN_copy(t, y)) { ------------------ | Branch (382:9): [True: 0, False: 19.3k] ------------------ 383| 0| goto end; 384| 0| } 385| 37.8k| for (j = e - i - 1; j > 0; j--) { ------------------ | Branch (385:25): [True: 18.5k, False: 19.3k] ------------------ 386| 18.5k| if (!BN_mod_sqr(t, t, p, ctx)) { ------------------ | Branch (386:11): [True: 0, False: 18.5k] ------------------ 387| 0| goto end; 388| 0| } 389| 18.5k| } 390| 19.3k| if (!BN_mod_mul(y, t, t, p, ctx) || ------------------ | Branch (390:9): [True: 0, False: 19.3k] ------------------ 391| 19.3k| !BN_mod_mul(x, x, t, p, ctx) || ------------------ | Branch (391:9): [True: 0, False: 19.3k] ------------------ 392| 19.3k| !BN_mod_mul(b, b, y, p, ctx)) { ------------------ | Branch (392:9): [True: 0, False: 19.3k] ------------------ 393| 0| goto end; 394| 0| } 395| | 396| | // e decreases each iteration, so this loop will terminate. 397| 19.3k| assert(i < e); 398| 19.3k| e = i; 399| 19.3k| } 400| | 401| 522|vrfy: 402| 522| if (!err) { ------------------ | Branch (402:7): [True: 522, False: 0] ------------------ 403| | // Verify the result. The input might have been not a square. 404| 522| if (!BN_mod_sqr(x, ret, p, ctx)) { ------------------ | Branch (404:9): [True: 0, False: 522] ------------------ 405| 0| err = 1; 406| 0| } 407| | 408| 522| if (!err && 0 != BN_cmp(x, A)) { ------------------ | Branch (408:9): [True: 522, False: 0] | Branch (408:17): [True: 11, False: 511] ------------------ 409| 11| OPENSSL_PUT_ERROR(BN, BN_R_NOT_A_SQUARE); ------------------ | | 441| 11| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 410| 11| err = 1; 411| 11| } 412| 522| } 413| | 414| 671|end: 415| 671| if (err) { ------------------ | Branch (415:7): [True: 160, False: 511] ------------------ 416| 160| if (ret != in) { ------------------ | Branch (416:9): [True: 0, False: 160] ------------------ 417| 0| BN_clear_free(ret); 418| 0| } 419| 160| ret = NULL; 420| 160| } 421| 671| BN_CTX_end(ctx); 422| 671| return ret; 423| 522|} BN_value_one: 56| 4| accessor_decorations type *name(void) { \ 57| 4| CRYPTO_once(name##_once_bss_get(), name##_init); \ 58| 4| /* See http://c-faq.com/ansi/constmismatch.html for why the following \ 59| 4| * cast is needed. */ \ 60| 4| return (const type *)name##_storage_bss_get(); \ 61| 4| } \ OPENSSL_built_in_curves: 56| 1.98k| accessor_decorations type *name(void) { \ 57| 1.98k| CRYPTO_once(name##_once_bss_get(), name##_init); \ 58| 1.98k| /* See http://c-faq.com/ansi/constmismatch.html for why the following \ 59| 1.98k| * cast is needed. */ \ 60| 1.98k| return (const type *)name##_storage_bss_get(); \ 61| 1.98k| } \ EC_GFp_mont_method: 56| 2| accessor_decorations type *name(void) { \ 57| 2| CRYPTO_once(name##_once_bss_get(), name##_init); \ 58| 2| /* See http://c-faq.com/ansi/constmismatch.html for why the following \ 59| 2| * cast is needed. */ \ 60| 2| return (const type *)name##_storage_bss_get(); \ 61| 2| } \ EC_GFp_nistp224_method: 56| 1| accessor_decorations type *name(void) { \ 57| 1| CRYPTO_once(name##_once_bss_get(), name##_init); \ 58| 1| /* See http://c-faq.com/ansi/constmismatch.html for why the following \ 59| 1| * cast is needed. */ \ 60| 1| return (const type *)name##_storage_bss_get(); \ 61| 1| } \ EC_GFp_nistz256_method: 56| 1| accessor_decorations type *name(void) { \ 57| 1| CRYPTO_once(name##_once_bss_get(), name##_init); \ 58| 1| /* See http://c-faq.com/ansi/constmismatch.html for why the following \ 59| 1| * cast is needed. */ \ 60| 1| return (const type *)name##_storage_bss_get(); \ 61| 1| } \ RSA_default_method: 56| 351| accessor_decorations type *name(void) { \ 57| 351| CRYPTO_once(name##_once_bss_get(), name##_init); \ 58| 351| /* See http://c-faq.com/ansi/constmismatch.html for why the following \ 59| 351| * cast is needed. */ \ 60| 351| return (const type *)name##_storage_bss_get(); \ 61| 351| } \ bcm.c:BN_value_one_once_bss_get: 42| 4| static CRYPTO_once_t *name##_bss_get(void) { return &name; } bcm.c:BN_value_one_init: 55| 1| static void name##_init(void) { name##_do_init(name##_storage_bss_get()); } \ bcm.c:BN_value_one_storage_bss_get: 39| 5| static type *name##_bss_get(void) { return &name; } bcm.c:OPENSSL_built_in_curves_once_bss_get: 42| 1.98k| static CRYPTO_once_t *name##_bss_get(void) { return &name; } bcm.c:OPENSSL_built_in_curves_init: 55| 1| static void name##_init(void) { name##_do_init(name##_storage_bss_get()); } \ bcm.c:OPENSSL_built_in_curves_storage_bss_get: 39| 1.98k| static type *name##_bss_get(void) { return &name; } bcm.c:built_in_groups_bss_get: 39| 723| static type *name##_bss_get(void) { return &name; } bcm.c:built_in_groups_lock_bss_get: 45| 1.45k| static struct CRYPTO_STATIC_MUTEX *name##_bss_get(void) { return &name; } bcm.c:g_ec_ex_data_class_bss_get: 48| 722| static CRYPTO_EX_DATA_CLASS *name##_bss_get(void) { return &name; } bcm.c:EC_GFp_mont_method_once_bss_get: 42| 2| static CRYPTO_once_t *name##_bss_get(void) { return &name; } bcm.c:EC_GFp_mont_method_init: 55| 1| static void name##_init(void) { name##_do_init(name##_storage_bss_get()); } \ bcm.c:EC_GFp_mont_method_storage_bss_get: 39| 3| static type *name##_bss_get(void) { return &name; } bcm.c:EC_GFp_nistp224_method_once_bss_get: 42| 1| static CRYPTO_once_t *name##_bss_get(void) { return &name; } bcm.c:EC_GFp_nistp224_method_init: 55| 1| static void name##_init(void) { name##_do_init(name##_storage_bss_get()); } \ bcm.c:EC_GFp_nistp224_method_storage_bss_get: 39| 2| static type *name##_bss_get(void) { return &name; } bcm.c:EC_GFp_nistz256_method_once_bss_get: 42| 1| static CRYPTO_once_t *name##_bss_get(void) { return &name; } bcm.c:EC_GFp_nistz256_method_init: 55| 1| static void name##_init(void) { name##_do_init(name##_storage_bss_get()); } \ bcm.c:EC_GFp_nistz256_method_storage_bss_get: 39| 2| static type *name##_bss_get(void) { return &name; } bcm.c:g_rsa_ex_data_class_bss_get: 48| 351| static CRYPTO_EX_DATA_CLASS *name##_bss_get(void) { return &name; } bcm.c:RSA_default_method_once_bss_get: 42| 351| static CRYPTO_once_t *name##_bss_get(void) { return &name; } bcm.c:RSA_default_method_init: 55| 1| static void name##_init(void) { name##_do_init(name##_storage_bss_get()); } \ bcm.c:RSA_default_method_storage_bss_get: 39| 352| static type *name##_bss_get(void) { return &name; } ec_group_new: 273| 4|EC_GROUP *ec_group_new(const EC_METHOD *meth) { 274| 4| EC_GROUP *ret; 275| | 276| 4| if (meth == NULL) { ------------------ | Branch (276:7): [True: 0, False: 4] ------------------ 277| 0| OPENSSL_PUT_ERROR(EC, EC_R_SLOT_FULL); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 278| 0| return NULL; 279| 0| } 280| | 281| 4| if (meth->group_init == 0) { ------------------ | Branch (281:7): [True: 0, False: 4] ------------------ 282| 0| OPENSSL_PUT_ERROR(EC, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 283| 0| return NULL; 284| 0| } 285| | 286| 4| ret = OPENSSL_malloc(sizeof(EC_GROUP)); 287| 4| if (ret == NULL) { ------------------ | Branch (287:7): [True: 0, False: 4] ------------------ 288| 0| return NULL; 289| 0| } 290| 4| OPENSSL_memset(ret, 0, sizeof(EC_GROUP)); 291| | 292| 4| ret->references = 1; 293| 4| ret->meth = meth; 294| 4| BN_init(&ret->order); 295| | 296| 4| if (!meth->group_init(ret)) { ------------------ | Branch (296:7): [True: 0, False: 4] ------------------ 297| 0| OPENSSL_free(ret); 298| 0| return NULL; 299| 0| } 300| | 301| 4| return ret; 302| 4|} EC_GROUP_new_by_curve_name: 505| 723|EC_GROUP *EC_GROUP_new_by_curve_name(int nid) { 506| 723| struct built_in_groups_st *groups = built_in_groups_bss_get(); 507| 723| EC_GROUP **group_ptr = NULL; 508| 723| const struct built_in_curves *const curves = OPENSSL_built_in_curves(); 509| 723| const struct built_in_curve *curve = NULL; 510| 2.66k| for (size_t i = 0; i < OPENSSL_NUM_BUILT_IN_CURVES; i++) { ------------------ | | 780| 2.66k|#define OPENSSL_NUM_BUILT_IN_CURVES 4 ------------------ | Branch (510:22): [True: 2.66k, False: 0] ------------------ 511| 2.66k| if (curves->curves[i].nid == nid) { ------------------ | Branch (511:9): [True: 723, False: 1.94k] ------------------ 512| 723| curve = &curves->curves[i]; 513| 723| group_ptr = &groups->groups[i]; 514| 723| break; 515| 723| } 516| 2.66k| } 517| | 518| 723| if (curve == NULL) { ------------------ | Branch (518:7): [True: 0, False: 723] ------------------ 519| 0| OPENSSL_PUT_ERROR(EC, EC_R_UNKNOWN_GROUP); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 520| 0| return NULL; 521| 0| } 522| | 523| 723| CRYPTO_STATIC_MUTEX_lock_read(built_in_groups_lock_bss_get()); 524| 723| EC_GROUP *ret = *group_ptr; 525| 723| CRYPTO_STATIC_MUTEX_unlock_read(built_in_groups_lock_bss_get()); 526| 723| if (ret != NULL) { ------------------ | Branch (526:7): [True: 719, False: 4] ------------------ 527| 719| return ret; 528| 719| } 529| | 530| 4| ret = ec_group_new_from_data(curve); 531| 4| if (ret == NULL) { ------------------ | Branch (531:7): [True: 0, False: 4] ------------------ 532| 0| return NULL; 533| 0| } 534| | 535| 4| EC_GROUP *to_free = NULL; 536| 4| CRYPTO_STATIC_MUTEX_lock_write(built_in_groups_lock_bss_get()); 537| 4| if (*group_ptr == NULL) { ------------------ | Branch (537:7): [True: 4, False: 0] ------------------ 538| 4| *group_ptr = ret; 539| | // Filling in |ret->curve_name| makes |EC_GROUP_free| and |EC_GROUP_dup| 540| | // into no-ops. At this point, |ret| is considered static. 541| 4| ret->curve_name = nid; 542| 4| } else { 543| 0| to_free = ret; 544| 0| ret = *group_ptr; 545| 0| } 546| 4| CRYPTO_STATIC_MUTEX_unlock_write(built_in_groups_lock_bss_get()); 547| | 548| 4| EC_GROUP_free(to_free); 549| 4| return ret; 550| 4|} EC_GROUP_free: 552| 3.43k|void EC_GROUP_free(EC_GROUP *group) { 553| 3.43k| if (group == NULL || ------------------ | Branch (553:7): [True: 755, False: 2.68k] ------------------ 554| | // Built-in curves are static. 555| 3.43k| group->curve_name != NID_undef || ------------------ | | 85| 6.11k|#define NID_undef 0 ------------------ | Branch (555:7): [True: 2.68k, False: 0] ------------------ 556| 3.43k| !CRYPTO_refcount_dec_and_test_zero(&group->references)) { ------------------ | Branch (556:7): [True: 0, False: 0] ------------------ 557| 3.43k| return; 558| 3.43k| } 559| | 560| 0| if (group->meth->group_finish != NULL) { ------------------ | Branch (560:7): [True: 0, False: 0] ------------------ 561| 0| group->meth->group_finish(group); 562| 0| } 563| | 564| 0| ec_point_free(group->generator, 0 /* don't free group */); 565| 0| BN_free(&group->order); 566| 0| BN_MONT_CTX_free(group->order_mont); 567| | 568| 0| OPENSSL_free(group); 569| 0|} EC_GROUP_dup: 571| 1.96k|EC_GROUP *EC_GROUP_dup(const EC_GROUP *a) { 572| 1.96k| if (a == NULL || ------------------ | Branch (572:7): [True: 0, False: 1.96k] ------------------ 573| | // Built-in curves are static. 574| 1.96k| a->curve_name != NID_undef) { ------------------ | | 85| 1.96k|#define NID_undef 0 ------------------ | Branch (574:7): [True: 1.95k, False: 4] ------------------ 575| 1.95k| return (EC_GROUP *)a; 576| 1.95k| } 577| | 578| | // Groups are logically immutable (but for |EC_GROUP_set_generator| which must 579| | // be called early on), so we simply take a reference. 580| 4| EC_GROUP *group = (EC_GROUP *)a; 581| 4| CRYPTO_refcount_inc(&group->references); 582| 4| return group; 583| 1.96k|} EC_GROUP_cmp: 585| 3.96k|int EC_GROUP_cmp(const EC_GROUP *a, const EC_GROUP *b, BN_CTX *ignored) { 586| | // Note this function returns 0 if equal and non-zero otherwise. 587| 3.96k| if (a == b) { ------------------ | Branch (587:7): [True: 3.96k, False: 0] ------------------ 588| 3.96k| return 0; 589| 3.96k| } 590| 0| if (a->curve_name != b->curve_name) { ------------------ | Branch (590:7): [True: 0, False: 0] ------------------ 591| 0| return 1; 592| 0| } 593| 0| if (a->curve_name != NID_undef) { ------------------ | | 85| 0|#define NID_undef 0 ------------------ | Branch (593:7): [True: 0, False: 0] ------------------ 594| | // Built-in curves may be compared by curve name alone. 595| 0| return 0; 596| 0| } 597| | 598| | // |a| and |b| are both custom curves. We compare the entire curve 599| | // structure. If |a| or |b| is incomplete (due to legacy OpenSSL mistakes, 600| | // custom curve construction is sadly done in two parts) but otherwise not the 601| | // same object, we consider them always unequal. 602| 0| return a->meth != b->meth || ------------------ | Branch (602:10): [True: 0, False: 0] ------------------ 603| 0| a->generator == NULL || ------------------ | Branch (603:10): [True: 0, False: 0] ------------------ 604| 0| b->generator == NULL || ------------------ | Branch (604:10): [True: 0, False: 0] ------------------ 605| 0| BN_cmp(&a->order, &b->order) != 0 || ------------------ | Branch (605:10): [True: 0, False: 0] ------------------ 606| 0| BN_cmp(&a->field, &b->field) != 0 || ------------------ | Branch (606:10): [True: 0, False: 0] ------------------ 607| 0| !ec_felem_equal(a, &a->a, &b->a) || ------------------ | Branch (607:10): [True: 0, False: 0] ------------------ 608| 0| !ec_felem_equal(a, &a->b, &b->b) || ------------------ | Branch (608:10): [True: 0, False: 0] ------------------ 609| 0| !ec_GFp_simple_points_equal(a, &a->generator->raw, &b->generator->raw); ------------------ | Branch (609:10): [True: 0, False: 0] ------------------ 610| 0|} EC_GROUP_get_curve_GFp: 639| 671| BIGNUM *out_b, BN_CTX *ctx) { 640| 671| return ec_GFp_simple_group_get_curve(group, out_p, out_a, out_b); 641| 671|} EC_GROUP_get_curve_name: 643| 514|int EC_GROUP_get_curve_name(const EC_GROUP *group) { return group->curve_name; } EC_POINT_new: 679| 1.24k|EC_POINT *EC_POINT_new(const EC_GROUP *group) { 680| 1.24k| if (group == NULL) { ------------------ | Branch (680:7): [True: 0, False: 1.24k] ------------------ 681| 0| OPENSSL_PUT_ERROR(EC, ERR_R_PASSED_NULL_PARAMETER); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 682| 0| return NULL; 683| 0| } 684| | 685| 1.24k| EC_POINT *ret = OPENSSL_malloc(sizeof *ret); 686| 1.24k| if (ret == NULL) { ------------------ | Branch (686:7): [True: 0, False: 1.24k] ------------------ 687| 0| return NULL; 688| 0| } 689| | 690| 1.24k| ret->group = EC_GROUP_dup(group); 691| 1.24k| ec_GFp_simple_point_init(&ret->raw); 692| 1.24k| return ret; 693| 1.24k|} EC_POINT_free: 705| 1.95k|void EC_POINT_free(EC_POINT *point) { 706| 1.95k| ec_point_free(point, 1 /* free group */); 707| 1.95k|} EC_POINT_copy: 711| 514|int EC_POINT_copy(EC_POINT *dest, const EC_POINT *src) { 712| 514| if (EC_GROUP_cmp(dest->group, src->group, NULL) != 0) { ------------------ | Branch (712:7): [True: 0, False: 514] ------------------ 713| 0| OPENSSL_PUT_ERROR(EC, EC_R_INCOMPATIBLE_OBJECTS); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 714| 0| return 0; 715| 0| } 716| 514| if (dest == src) { ------------------ | Branch (716:7): [True: 0, False: 514] ------------------ 717| 0| return 1; 718| 0| } 719| 514| ec_GFp_simple_point_copy(&dest->raw, &src->raw); 720| 514| return 1; 721| 514|} EC_POINT_dup: 723| 514|EC_POINT *EC_POINT_dup(const EC_POINT *a, const EC_GROUP *group) { 724| 514| if (a == NULL) { ------------------ | Branch (724:7): [True: 0, False: 514] ------------------ 725| 0| return NULL; 726| 0| } 727| | 728| 514| EC_POINT *ret = EC_POINT_new(group); 729| 514| if (ret == NULL || ------------------ | Branch (729:7): [True: 0, False: 514] ------------------ 730| 514| !EC_POINT_copy(ret, a)) { ------------------ | Branch (730:7): [True: 0, False: 514] ------------------ 731| 0| EC_POINT_free(ret); 732| 0| return NULL; 733| 0| } 734| | 735| 514| return ret; 736| 514|} ec_affine_to_jacobian: 805| 518| const EC_AFFINE *p) { 806| 518| out->X = p->X; 807| 518| out->Y = p->Y; 808| 518| out->Z = group->one; 809| 518|} ec_jacobian_to_affine: 812| 514| const EC_JACOBIAN *p) { 813| 514| return group->meth->point_get_affine_coordinates(group, p, &out->X, &out->Y); 814| 514|} ec_point_set_affine_coordinates: 826| 520| const EC_FELEM *x, const EC_FELEM *y) { 827| 520| void (*const felem_mul)(const EC_GROUP *, EC_FELEM *r, const EC_FELEM *a, 828| 520| const EC_FELEM *b) = group->meth->felem_mul; 829| 520| void (*const felem_sqr)(const EC_GROUP *, EC_FELEM *r, const EC_FELEM *a) = 830| 520| group->meth->felem_sqr; 831| | 832| | // Check if the point is on the curve. 833| 520| EC_FELEM lhs, rhs; 834| 520| felem_sqr(group, &lhs, y); // lhs = y^2 835| 520| felem_sqr(group, &rhs, x); // rhs = x^2 836| 520| ec_felem_add(group, &rhs, &rhs, &group->a); // rhs = x^2 + a 837| 520| felem_mul(group, &rhs, &rhs, x); // rhs = x^3 + ax 838| 520| ec_felem_add(group, &rhs, &rhs, &group->b); // rhs = x^3 + ax + b 839| 520| if (!ec_felem_equal(group, &lhs, &rhs)) { ------------------ | Branch (839:7): [True: 2, False: 518] ------------------ 840| 2| OPENSSL_PUT_ERROR(EC, EC_R_POINT_IS_NOT_ON_CURVE); ------------------ | | 441| 2| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 841| | // In the event of an error, defend against the caller not checking the 842| | // return value by setting a known safe value. Note this may not be possible 843| | // if the caller is in the process of constructing an arbitrary group and 844| | // the generator is missing. 845| 2| if (group->generator != NULL) { ------------------ | Branch (845:9): [True: 2, False: 0] ------------------ 846| 2| assert(ec_felem_equal(group, &group->one, &group->generator->raw.Z)); 847| 2| out->X = group->generator->raw.X; 848| 2| out->Y = group->generator->raw.Y; 849| 2| } 850| 2| return 0; 851| 2| } 852| | 853| 518| out->X = *x; 854| 518| out->Y = *y; 855| 518| return 1; 856| 520|} EC_POINT_set_affine_coordinates_GFp: 860| 511| BN_CTX *ctx) { 861| 511| if (EC_GROUP_cmp(group, point->group, NULL) != 0) { ------------------ | Branch (861:7): [True: 0, False: 511] ------------------ 862| 0| OPENSSL_PUT_ERROR(EC, EC_R_INCOMPATIBLE_OBJECTS); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 863| 0| return 0; 864| 0| } 865| | 866| 511| if (x == NULL || y == NULL) { ------------------ | Branch (866:7): [True: 0, False: 511] | Branch (866:20): [True: 0, False: 511] ------------------ 867| 0| OPENSSL_PUT_ERROR(EC, ERR_R_PASSED_NULL_PARAMETER); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 868| 0| return 0; 869| 0| } 870| | 871| 511| EC_FELEM x_felem, y_felem; 872| 511| EC_AFFINE affine; 873| 511| if (!ec_bignum_to_felem(group, &x_felem, x) || ------------------ | Branch (873:7): [True: 0, False: 511] ------------------ 874| 511| !ec_bignum_to_felem(group, &y_felem, y) || ------------------ | Branch (874:7): [True: 0, False: 511] ------------------ 875| 511| !ec_point_set_affine_coordinates(group, &affine, &x_felem, &y_felem)) { ------------------ | Branch (875:7): [True: 0, False: 511] ------------------ 876| | // In the event of an error, defend against the caller not checking the 877| | // return value by setting a known safe value. 878| 0| ec_set_to_safe_point(group, &point->raw); 879| 0| return 0; 880| 0| } 881| | 882| 511| ec_affine_to_jacobian(group, &point->raw, &affine); 883| 511| return 1; 884| 511|} ec_set_to_safe_point: 1224| 18|void ec_set_to_safe_point(const EC_GROUP *group, EC_JACOBIAN *out) { 1225| 18| if (group->generator != NULL) { ------------------ | Branch (1225:7): [True: 18, False: 0] ------------------ 1226| 18| ec_GFp_simple_point_copy(out, &group->generator->raw); 1227| 18| } else { 1228| | // The generator can be missing if the caller is in the process of 1229| | // constructing an arbitrary group. In this case, we give up and use the 1230| | // point at infinity. 1231| 0| ec_GFp_simple_point_set_to_infinity(group, out); 1232| 0| } 1233| 18|} bcm.c:OPENSSL_built_in_curves_do_init: 218| 1|DEFINE_METHOD_FUNCTION(struct built_in_curves, OPENSSL_built_in_curves) { 219| | // 1.3.132.0.35 220| 1| static const uint8_t kOIDP521[] = {0x2b, 0x81, 0x04, 0x00, 0x23}; 221| 1| out->curves[0].nid = NID_secp521r1; ------------------ | | 3172| 1|#define NID_secp521r1 716 ------------------ 222| 1| out->curves[0].oid = kOIDP521; 223| 1| out->curves[0].oid_len = sizeof(kOIDP521); 224| 1| out->curves[0].comment = "NIST P-521"; 225| 1| out->curves[0].param_len = 66; 226| 1| out->curves[0].params = kP521Params; 227| 1| out->curves[0].method = EC_GFp_mont_method(); 228| | 229| | // 1.3.132.0.34 230| 1| static const uint8_t kOIDP384[] = {0x2b, 0x81, 0x04, 0x00, 0x22}; 231| 1| out->curves[1].nid = NID_secp384r1; ------------------ | | 3168| 1|#define NID_secp384r1 715 ------------------ 232| 1| out->curves[1].oid = kOIDP384; 233| 1| out->curves[1].oid_len = sizeof(kOIDP384); 234| 1| out->curves[1].comment = "NIST P-384"; 235| 1| out->curves[1].param_len = 48; 236| 1| out->curves[1].params = kP384Params; 237| 1| out->curves[1].method = EC_GFp_mont_method(); 238| | 239| | // 1.2.840.10045.3.1.7 240| 1| static const uint8_t kOIDP256[] = {0x2a, 0x86, 0x48, 0xce, 241| 1| 0x3d, 0x03, 0x01, 0x07}; 242| 1| out->curves[2].nid = NID_X9_62_prime256v1; ------------------ | | 1914| 1|#define NID_X9_62_prime256v1 415 ------------------ 243| 1| out->curves[2].oid = kOIDP256; 244| 1| out->curves[2].oid_len = sizeof(kOIDP256); 245| 1| out->curves[2].comment = "NIST P-256"; 246| 1| out->curves[2].param_len = 32; 247| 1| out->curves[2].params = kP256Params; 248| 1| out->curves[2].method = 249| 1|#if !defined(OPENSSL_NO_ASM) && \ 250| 1| (defined(OPENSSL_X86_64) || defined(OPENSSL_AARCH64)) && \ 251| 1| !defined(OPENSSL_SMALL) 252| 1| EC_GFp_nistz256_method(); 253| |#else 254| | EC_GFp_nistp256_method(); 255| |#endif 256| | 257| | // 1.3.132.0.33 258| 1| static const uint8_t kOIDP224[] = {0x2b, 0x81, 0x04, 0x00, 0x21}; 259| 1| out->curves[3].nid = NID_secp224r1; ------------------ | | 3160| 1|#define NID_secp224r1 713 ------------------ 260| 1| out->curves[3].oid = kOIDP224; 261| 1| out->curves[3].oid_len = sizeof(kOIDP224); 262| 1| out->curves[3].comment = "NIST P-224"; 263| 1| out->curves[3].param_len = 28; 264| 1| out->curves[3].params = kP224Params; 265| 1| out->curves[3].method = 266| 1|#if defined(BORINGSSL_HAS_UINT128) && !defined(OPENSSL_SMALL) 267| 1| EC_GFp_nistp224_method(); 268| |#else 269| | EC_GFp_mont_method(); 270| |#endif 271| 1|} bcm.c:ec_group_set_generator: 305| 4| const BIGNUM *order) { 306| 4| assert(group->generator == NULL); 307| | 308| 4| if (!BN_copy(&group->order, order)) { ------------------ | Branch (308:7): [True: 0, False: 4] ------------------ 309| 0| return 0; 310| 0| } 311| | // Store the order in minimal form, so it can be used with |BN_ULONG| arrays. 312| 4| bn_set_minimal_width(&group->order); 313| | 314| 4| BN_MONT_CTX_free(group->order_mont); 315| 4| group->order_mont = BN_MONT_CTX_new_for_modulus(&group->order, NULL); 316| 4| if (group->order_mont == NULL) { ------------------ | Branch (316:7): [True: 0, False: 4] ------------------ 317| 0| return 0; 318| 0| } 319| | 320| 4| group->field_greater_than_order = BN_cmp(&group->field, order) > 0; 321| 4| if (group->field_greater_than_order) { ------------------ | Branch (321:7): [True: 4, False: 0] ------------------ 322| 4| BIGNUM tmp; 323| 4| BN_init(&tmp); 324| 4| int ok = 325| 4| BN_sub(&tmp, &group->field, order) && ------------------ | Branch (325:9): [True: 4, False: 0] ------------------ 326| 4| bn_copy_words(group->field_minus_order.words, group->field.width, &tmp); ------------------ | Branch (326:9): [True: 4, False: 0] ------------------ 327| 4| BN_free(&tmp); 328| 4| if (!ok) { ------------------ | Branch (328:9): [True: 0, False: 4] ------------------ 329| 0| return 0; 330| 0| } 331| 4| } 332| | 333| 4| group->generator = EC_POINT_new(group); 334| 4| if (group->generator == NULL) { ------------------ | Branch (334:7): [True: 0, False: 4] ------------------ 335| 0| return 0; 336| 0| } 337| 4| ec_affine_to_jacobian(group, &group->generator->raw, generator); 338| 4| assert(ec_felem_equal(group, &group->one, &group->generator->raw.Z)); 339| | 340| | // Avoid a reference cycle. |group->generator| does not maintain an owning 341| | // pointer to |group|. 342| 4| int is_zero = CRYPTO_refcount_dec_and_test_zero(&group->references); 343| | 344| 4| assert(!is_zero); 345| 4| (void)is_zero; 346| 4| return 1; 347| 4|} bcm.c:ec_group_new_from_data: 442| 4|static EC_GROUP *ec_group_new_from_data(const struct built_in_curve *curve) { 443| 4| EC_GROUP *group = NULL; 444| 4| BIGNUM *p = NULL, *a = NULL, *b = NULL, *order = NULL; 445| 4| int ok = 0; 446| | 447| 4| BN_CTX *ctx = BN_CTX_new(); 448| 4| if (ctx == NULL) { ------------------ | Branch (448:7): [True: 0, False: 4] ------------------ 449| 0| goto err; 450| 0| } 451| | 452| 4| const unsigned param_len = curve->param_len; 453| 4| const uint8_t *params = curve->params; 454| | 455| 4| if (!(p = BN_bin2bn(params + 0 * param_len, param_len, NULL)) || ------------------ | Branch (455:7): [True: 0, False: 4] ------------------ 456| 4| !(a = BN_bin2bn(params + 1 * param_len, param_len, NULL)) || ------------------ | Branch (456:7): [True: 0, False: 4] ------------------ 457| 4| !(b = BN_bin2bn(params + 2 * param_len, param_len, NULL)) || ------------------ | Branch (457:7): [True: 0, False: 4] ------------------ 458| 4| !(order = BN_bin2bn(params + 5 * param_len, param_len, NULL))) { ------------------ | Branch (458:7): [True: 0, False: 4] ------------------ 459| 0| OPENSSL_PUT_ERROR(EC, ERR_R_BN_LIB); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 460| 0| goto err; 461| 0| } 462| | 463| 4| group = ec_group_new(curve->method); 464| 4| if (group == NULL || ------------------ | Branch (464:7): [True: 0, False: 4] ------------------ 465| 4| !group->meth->group_set_curve(group, p, a, b, ctx)) { ------------------ | Branch (465:7): [True: 0, False: 4] ------------------ 466| 0| OPENSSL_PUT_ERROR(EC, ERR_R_EC_LIB); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 467| 0| goto err; 468| 0| } 469| | 470| 4| EC_AFFINE G; 471| 4| EC_FELEM x, y; 472| 4| if (!ec_felem_from_bytes(group, &x, params + 3 * param_len, param_len) || ------------------ | Branch (472:7): [True: 0, False: 4] ------------------ 473| 4| !ec_felem_from_bytes(group, &y, params + 4 * param_len, param_len) || ------------------ | Branch (473:7): [True: 0, False: 4] ------------------ 474| 4| !ec_point_set_affine_coordinates(group, &G, &x, &y)) { ------------------ | Branch (474:7): [True: 0, False: 4] ------------------ 475| 0| goto err; 476| 0| } 477| | 478| 4| if (!ec_group_set_generator(group, &G, order)) { ------------------ | Branch (478:7): [True: 0, False: 4] ------------------ 479| 0| goto err; 480| 0| } 481| | 482| 4| ok = 1; 483| | 484| 4|err: 485| 4| if (!ok) { ------------------ | Branch (485:7): [True: 0, False: 4] ------------------ 486| 0| EC_GROUP_free(group); 487| 0| group = NULL; 488| 0| } 489| 4| BN_CTX_free(ctx); 490| 4| BN_free(p); 491| 4| BN_free(a); 492| 4| BN_free(b); 493| 4| BN_free(order); 494| 4| return group; 495| 4|} bcm.c:ec_point_free: 695| 1.95k|static void ec_point_free(EC_POINT *point, int free_group) { 696| 1.95k| if (!point) { ------------------ | Branch (696:7): [True: 722, False: 1.23k] ------------------ 697| 722| return; 698| 722| } 699| 1.23k| if (free_group) { ------------------ | Branch (699:7): [True: 1.23k, False: 0] ------------------ 700| 1.23k| EC_GROUP_free(point->group); 701| 1.23k| } 702| 1.23k| OPENSSL_free(point); 703| 1.23k|} EC_KEY_new: 106| 722|EC_KEY *EC_KEY_new(void) { return EC_KEY_new_method(NULL); } EC_KEY_new_method: 108| 722|EC_KEY *EC_KEY_new_method(const ENGINE *engine) { 109| 722| EC_KEY *ret = OPENSSL_malloc(sizeof(EC_KEY)); 110| 722| if (ret == NULL) { ------------------ | Branch (110:7): [True: 0, False: 722] ------------------ 111| 0| return NULL; 112| 0| } 113| | 114| 722| OPENSSL_memset(ret, 0, sizeof(EC_KEY)); 115| | 116| 722| if (engine) { ------------------ | Branch (116:7): [True: 0, False: 722] ------------------ 117| 0| ret->ecdsa_meth = ENGINE_get_ECDSA_method(engine); 118| 0| } 119| 722| if (ret->ecdsa_meth) { ------------------ | Branch (119:7): [True: 0, False: 722] ------------------ 120| 0| METHOD_ref(ret->ecdsa_meth); 121| 0| } 122| | 123| 722| ret->conv_form = POINT_CONVERSION_UNCOMPRESSED; 124| 722| ret->references = 1; 125| | 126| 722| CRYPTO_new_ex_data(&ret->ex_data); 127| | 128| 722| if (ret->ecdsa_meth && ret->ecdsa_meth->init && !ret->ecdsa_meth->init(ret)) { ------------------ | Branch (128:7): [True: 0, False: 722] | Branch (128:26): [True: 0, False: 0] | Branch (128:51): [True: 0, False: 0] ------------------ 129| 0| CRYPTO_free_ex_data(g_ec_ex_data_class_bss_get(), ret, &ret->ex_data); 130| 0| if (ret->ecdsa_meth) { ------------------ | Branch (130:9): [True: 0, False: 0] ------------------ 131| 0| METHOD_unref(ret->ecdsa_meth); 132| 0| } 133| 0| OPENSSL_free(ret); 134| 0| return NULL; 135| 0| } 136| | 137| 722| return ret; 138| 722|} EC_KEY_free: 153| 990|void EC_KEY_free(EC_KEY *r) { 154| 990| if (r == NULL) { ------------------ | Branch (154:7): [True: 268, False: 722] ------------------ 155| 268| return; 156| 268| } 157| | 158| 722| if (!CRYPTO_refcount_dec_and_test_zero(&r->references)) { ------------------ | Branch (158:7): [True: 0, False: 722] ------------------ 159| 0| return; 160| 0| } 161| | 162| 722| if (r->ecdsa_meth) { ------------------ | Branch (162:7): [True: 0, False: 722] ------------------ 163| 0| if (r->ecdsa_meth->finish) { ------------------ | Branch (163:9): [True: 0, False: 0] ------------------ 164| 0| r->ecdsa_meth->finish(r); 165| 0| } 166| 0| METHOD_unref(r->ecdsa_meth); 167| 0| } 168| | 169| 722| EC_GROUP_free(r->group); 170| 722| EC_POINT_free(r->pub_key); 171| 722| ec_wrapped_scalar_free(r->priv_key); 172| | 173| 722| CRYPTO_free_ex_data(g_ec_ex_data_class_bss_get(), r, &r->ex_data); 174| | 175| 722| OPENSSL_free(r); 176| 722|} EC_KEY_get0_group: 213| 514|const EC_GROUP *EC_KEY_get0_group(const EC_KEY *key) { return key->group; } EC_KEY_set_group: 215| 722|int EC_KEY_set_group(EC_KEY *key, const EC_GROUP *group) { 216| | // If |key| already has a group, it is an error to switch to another one. 217| 722| if (key->group != NULL) { ------------------ | Branch (217:7): [True: 0, False: 722] ------------------ 218| 0| if (EC_GROUP_cmp(key->group, group, NULL) != 0) { ------------------ | Branch (218:9): [True: 0, False: 0] ------------------ 219| 0| OPENSSL_PUT_ERROR(EC, EC_R_GROUP_MISMATCH); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 220| 0| return 0; 221| 0| } 222| 0| return 1; 223| 0| } 224| | 225| 722| assert(key->priv_key == NULL); 226| 722| assert(key->pub_key == NULL); 227| | 228| 722| EC_GROUP_free(key->group); 229| 722| key->group = EC_GROUP_dup(group); 230| 722| return key->group != NULL; 231| 722|} EC_KEY_get0_public_key: 258| 514|const EC_POINT *EC_KEY_get0_public_key(const EC_KEY *key) { 259| 514| return key->pub_key; 260| 514|} EC_KEY_set_public_key: 262| 514|int EC_KEY_set_public_key(EC_KEY *key, const EC_POINT *pub_key) { 263| 514| if (key->group == NULL) { ------------------ | Branch (263:7): [True: 0, False: 514] ------------------ 264| 0| OPENSSL_PUT_ERROR(EC, EC_R_MISSING_PARAMETERS); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 265| 0| return 0; 266| 0| } 267| | 268| 514| if (pub_key != NULL && EC_GROUP_cmp(key->group, pub_key->group, NULL) != 0) { ------------------ | Branch (268:7): [True: 514, False: 0] | Branch (268:26): [True: 0, False: 514] ------------------ 269| 0| OPENSSL_PUT_ERROR(EC, EC_R_GROUP_MISMATCH); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 270| 0| return 0; 271| 0| } 272| | 273| 514| EC_POINT_free(key->pub_key); 274| 514| key->pub_key = EC_POINT_dup(pub_key, key->group); 275| 514| return (key->pub_key == NULL) ? 0 : 1; ------------------ | Branch (275:10): [True: 0, False: 514] ------------------ 276| 514|} EC_KEY_oct2key: 395| 722|int EC_KEY_oct2key(EC_KEY *key, const uint8_t *in, size_t len, BN_CTX *ctx) { 396| 722| if (key->group == NULL) { ------------------ | Branch (396:7): [True: 0, False: 722] ------------------ 397| 0| OPENSSL_PUT_ERROR(EC, EC_R_MISSING_PARAMETERS); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 398| 0| return 0; 399| 0| } 400| | 401| 722| EC_POINT *point = EC_POINT_new(key->group); 402| 722| int ok = point != NULL && ------------------ | Branch (402:12): [True: 722, False: 0] ------------------ 403| 722| EC_POINT_oct2point(key->group, point, in, len, ctx) && ------------------ | Branch (403:12): [True: 514, False: 208] ------------------ 404| 722| EC_KEY_set_public_key(key, point); ------------------ | Branch (404:12): [True: 514, False: 0] ------------------ 405| 722| EC_POINT_free(point); 406| 722| return ok; 407| 722|} bcm.c:ec_wrapped_scalar_free: 102| 722|static void ec_wrapped_scalar_free(EC_WRAPPED_SCALAR *scalar) { 103| 722| OPENSSL_free(scalar); 104| 722|} ec_GFp_mont_group_init: 79| 3|int ec_GFp_mont_group_init(EC_GROUP *group) { 80| 3| int ok; 81| | 82| 3| ok = ec_GFp_simple_group_init(group); 83| 3| group->mont = NULL; 84| 3| return ok; 85| 3|} ec_GFp_mont_group_set_curve: 94| 3| const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx) { 95| 3| BN_MONT_CTX_free(group->mont); 96| 3| group->mont = BN_MONT_CTX_new_for_modulus(p, ctx); 97| 3| if (group->mont == NULL) { ------------------ | Branch (97:7): [True: 0, False: 3] ------------------ 98| 0| OPENSSL_PUT_ERROR(EC, ERR_R_BN_LIB); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 99| 0| return 0; 100| 0| } 101| | 102| 3| if (!ec_GFp_simple_group_set_curve(group, p, a, b, ctx)) { ------------------ | Branch (102:7): [True: 0, False: 3] ------------------ 103| 0| BN_MONT_CTX_free(group->mont); 104| 0| group->mont = NULL; 105| 0| return 0; 106| 0| } 107| | 108| 3| return 1; 109| 3|} ec_GFp_mont_felem_mul: 131| 243| const EC_FELEM *a, const EC_FELEM *b) { 132| 243| bn_mod_mul_montgomery_small(r->words, a->words, b->words, group->field.width, 133| 243| group->mont); 134| 243|} ec_GFp_mont_felem_sqr: 137| 271| const EC_FELEM *a) { 138| 271| bn_mod_mul_montgomery_small(r->words, a->words, a->words, group->field.width, 139| 271| group->mont); 140| 271|} ec_GFp_mont_felem_to_bytes: 143| 458| size_t *out_len, const EC_FELEM *in) { 144| 458| EC_FELEM tmp; 145| 458| ec_GFp_mont_felem_from_montgomery(group, &tmp, in); 146| 458| ec_GFp_simple_felem_to_bytes(group, out, out_len, &tmp); 147| 458|} ec_GFp_mont_felem_from_bytes: 150| 240| const uint8_t *in, size_t len) { 151| 240| if (!ec_GFp_simple_felem_from_bytes(group, out, in, len)) { ------------------ | Branch (151:7): [True: 2, False: 238] ------------------ 152| 2| return 0; 153| 2| } 154| | 155| 238| ec_GFp_mont_felem_to_montgomery(group, out, out); 156| 238| return 1; 157| 240|} bcm.c:ec_GFp_mont_felem_from_montgomery: 119| 458| const EC_FELEM *in) { 120| 458| bn_from_montgomery_small(out->words, group->field.width, in->words, 121| 458| group->field.width, group->mont); 122| 458|} bcm.c:ec_GFp_mont_felem_to_montgomery: 112| 238| EC_FELEM *out, const EC_FELEM *in) { 113| 238| bn_to_montgomery_small(out->words, in->words, group->field.width, 114| 238| group->mont); 115| 238|} bcm.c:EC_GFp_mont_method_do_init: 501| 1|DEFINE_METHOD_FUNCTION(EC_METHOD, EC_GFp_mont_method) { 502| 1| out->group_init = ec_GFp_mont_group_init; 503| 1| out->group_finish = ec_GFp_mont_group_finish; 504| 1| out->group_set_curve = ec_GFp_mont_group_set_curve; 505| 1| out->point_get_affine_coordinates = ec_GFp_mont_point_get_affine_coordinates; 506| 1| out->jacobian_to_affine_batch = ec_GFp_mont_jacobian_to_affine_batch; 507| 1| out->add = ec_GFp_mont_add; 508| 1| out->dbl = ec_GFp_mont_dbl; 509| 1| out->mul = ec_GFp_mont_mul; 510| 1| out->mul_base = ec_GFp_mont_mul_base; 511| 1| out->mul_batch = ec_GFp_mont_mul_batch; 512| 1| out->mul_public_batch = ec_GFp_mont_mul_public_batch; 513| 1| out->init_precomp = ec_GFp_mont_init_precomp; 514| 1| out->mul_precomp = ec_GFp_mont_mul_precomp; 515| 1| out->felem_mul = ec_GFp_mont_felem_mul; 516| 1| out->felem_sqr = ec_GFp_mont_felem_sqr; 517| 1| out->felem_to_bytes = ec_GFp_mont_felem_to_bytes; 518| 1| out->felem_from_bytes = ec_GFp_mont_felem_from_bytes; 519| 1| out->felem_reduce = ec_GFp_mont_felem_reduce; 520| 1| out->felem_exp = ec_GFp_mont_felem_exp; 521| 1| out->scalar_inv0_montgomery = ec_simple_scalar_inv0_montgomery; 522| 1| out->scalar_to_montgomery_inv_vartime = 523| 1| ec_simple_scalar_to_montgomery_inv_vartime; 524| 1| out->cmp_x_coordinate = ec_GFp_mont_cmp_x_coordinate; 525| 1|} bcm.c:ec_GFp_mont_point_get_affine_coordinates: 179| 43| EC_FELEM *x, EC_FELEM *y) { 180| 43| if (constant_time_declassify_int( ------------------ | Branch (180:7): [True: 0, False: 43] ------------------ 181| 43| ec_GFp_simple_is_at_infinity(group, point))) { 182| 0| OPENSSL_PUT_ERROR(EC, EC_R_POINT_AT_INFINITY); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 183| 0| return 0; 184| 0| } 185| | 186| | // Transform (X, Y, Z) into (x, y) := (X/Z^2, Y/Z^3). Note the check above 187| | // ensures |point->Z| is non-zero, so the inverse always exists. 188| 43| EC_FELEM z1, z2; 189| 43| ec_GFp_mont_felem_inv0(group, &z2, &point->Z); 190| 43| ec_GFp_mont_felem_sqr(group, &z1, &z2); 191| | 192| 43| if (x != NULL) { ------------------ | Branch (192:7): [True: 43, False: 0] ------------------ 193| 43| ec_GFp_mont_felem_mul(group, x, &point->X, &z1); 194| 43| } 195| | 196| 43| if (y != NULL) { ------------------ | Branch (196:7): [True: 43, False: 0] ------------------ 197| 43| ec_GFp_mont_felem_mul(group, &z1, &z1, &z2); 198| 43| ec_GFp_mont_felem_mul(group, y, &point->Y, &z1); 199| 43| } 200| | 201| 43| return 1; 202| 43|} bcm.c:ec_GFp_mont_felem_inv0: 125| 43| const EC_FELEM *a) { 126| 43| bn_mod_inverse0_prime_mont_small(out->words, a->words, group->field.width, 127| 43| group->mont); 128| 43|} ec_bignum_to_felem: 26| 1.03k|int ec_bignum_to_felem(const EC_GROUP *group, EC_FELEM *out, const BIGNUM *in) { 27| 1.03k| uint8_t bytes[EC_MAX_BYTES]; 28| 1.03k| size_t len = BN_num_bytes(&group->field); 29| 1.03k| assert(sizeof(bytes) >= len); 30| 1.03k| if (BN_is_negative(in) || ------------------ | Branch (30:7): [True: 0, False: 1.03k] ------------------ 31| 1.03k| BN_cmp(in, &group->field) >= 0 || ------------------ | Branch (31:7): [True: 0, False: 1.03k] ------------------ 32| 1.03k| !BN_bn2bin_padded(bytes, len, in)) { ------------------ | Branch (32:7): [True: 0, False: 1.03k] ------------------ 33| 0| OPENSSL_PUT_ERROR(EC, EC_R_COORDINATES_OUT_OF_RANGE); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 34| 0| return 0; 35| 0| } 36| | 37| 1.03k| return ec_felem_from_bytes(group, out, bytes, len); 38| 1.03k|} ec_felem_to_bignum: 40| 1.34k|int ec_felem_to_bignum(const EC_GROUP *group, BIGNUM *out, const EC_FELEM *in) { 41| 1.34k| uint8_t bytes[EC_MAX_BYTES]; 42| 1.34k| size_t len; 43| 1.34k| ec_felem_to_bytes(group, bytes, &len, in); 44| 1.34k| return BN_bin2bn(bytes, len, out) != NULL; 45| 1.34k|} ec_felem_to_bytes: 48| 2.37k| const EC_FELEM *in) { 49| 2.37k| group->meth->felem_to_bytes(group, out, out_len, in); 50| 2.37k|} ec_felem_from_bytes: 53| 1.05k| size_t len) { 54| 1.05k| return group->meth->felem_from_bytes(group, out, in, len); 55| 1.05k|} ec_felem_add: 70| 1.04k| const EC_FELEM *b) { 71| 1.04k| EC_FELEM tmp; 72| 1.04k| bn_mod_add_words(out->words, a->words, b->words, group->field.d, tmp.words, 73| 1.04k| group->field.width); 74| 1.04k|} ec_felem_non_zero_mask: 83| 1.02k|BN_ULONG ec_felem_non_zero_mask(const EC_GROUP *group, const EC_FELEM *a) { 84| 1.02k| BN_ULONG mask = 0; 85| 5.37k| for (int i = 0; i < group->field.width; i++) { ------------------ | Branch (85:19): [True: 4.34k, False: 1.02k] ------------------ 86| 4.34k| mask |= a->words[i]; 87| 4.34k| } 88| 1.02k| return ~constant_time_is_zero_w(mask); 89| 1.02k|} ec_felem_equal: 97| 526| const EC_FELEM *b) { 98| 526| return CRYPTO_memcmp(a->words, b->words, 99| 526| group->field.width * sizeof(BN_ULONG)) == 0; 100| 526|} ec_point_byte_len: 76| 1.02k|size_t ec_point_byte_len(const EC_GROUP *group, point_conversion_form_t form) { 77| 1.02k| if (form != POINT_CONVERSION_COMPRESSED && ------------------ | Branch (77:7): [True: 1.02k, False: 0] ------------------ 78| 1.02k| form != POINT_CONVERSION_UNCOMPRESSED) { ------------------ | Branch (78:7): [True: 0, False: 1.02k] ------------------ 79| 0| OPENSSL_PUT_ERROR(EC, EC_R_INVALID_FORM); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 80| 0| return 0; 81| 0| } 82| | 83| 1.02k| const size_t field_len = BN_num_bytes(&group->field); 84| 1.02k| size_t output_len = 1 /* type byte */ + field_len; 85| 1.02k| if (form == POINT_CONVERSION_UNCOMPRESSED) { ------------------ | Branch (85:7): [True: 1.02k, False: 0] ------------------ 86| | // Uncompressed points have a second coordinate. 87| 1.02k| output_len += field_len; 88| 1.02k| } 89| 1.02k| return output_len; 90| 1.02k|} ec_point_to_bytes: 94| 514| size_t max_out) { 95| 514| size_t output_len = ec_point_byte_len(group, form); 96| 514| if (max_out < output_len) { ------------------ | Branch (96:7): [True: 0, False: 514] ------------------ 97| 0| OPENSSL_PUT_ERROR(EC, EC_R_BUFFER_TOO_SMALL); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 98| 0| return 0; 99| 0| } 100| | 101| 514| size_t field_len; 102| 514| ec_felem_to_bytes(group, buf + 1, &field_len, &point->X); 103| 514| assert(field_len == BN_num_bytes(&group->field)); 104| | 105| 514| if (form == POINT_CONVERSION_UNCOMPRESSED) { ------------------ | Branch (105:7): [True: 514, False: 0] ------------------ 106| 514| ec_felem_to_bytes(group, buf + 1 + field_len, &field_len, &point->Y); 107| 514| assert(field_len == BN_num_bytes(&group->field)); 108| 514| buf[0] = form; 109| 514| } else { 110| 0| uint8_t y_buf[EC_MAX_BYTES]; 111| 0| ec_felem_to_bytes(group, y_buf, &field_len, &point->Y); 112| 0| buf[0] = form + (y_buf[field_len - 1] & 1); 113| 0| } 114| | 115| 514| return output_len; 116| 514|} ec_point_from_uncompressed: 119| 21| const uint8_t *in, size_t len) { 120| 21| const size_t field_len = BN_num_bytes(&group->field); 121| 21| if (len != 1 + 2 * field_len || in[0] != POINT_CONVERSION_UNCOMPRESSED) { ------------------ | Branch (121:7): [True: 11, False: 10] | Branch (121:35): [True: 0, False: 10] ------------------ 122| 11| OPENSSL_PUT_ERROR(EC, EC_R_INVALID_ENCODING); ------------------ | | 441| 11| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 123| 11| return 0; 124| 11| } 125| | 126| 10| EC_FELEM x, y; 127| 10| if (!ec_felem_from_bytes(group, &x, in + 1, field_len) || ------------------ | Branch (127:7): [True: 3, False: 7] ------------------ 128| 10| !ec_felem_from_bytes(group, &y, in + 1 + field_len, field_len) || ------------------ | Branch (128:7): [True: 2, False: 5] ------------------ 129| 10| !ec_point_set_affine_coordinates(group, out, &x, &y)) { ------------------ | Branch (129:7): [True: 2, False: 3] ------------------ 130| 7| return 0; 131| 7| } 132| | 133| 3| return 1; 134| 10|} EC_POINT_oct2point: 203| 722| const uint8_t *buf, size_t len, BN_CTX *ctx) { 204| 722| if (EC_GROUP_cmp(group, point->group, NULL) != 0) { ------------------ | Branch (204:7): [True: 0, False: 722] ------------------ 205| 0| OPENSSL_PUT_ERROR(EC, EC_R_INCOMPATIBLE_OBJECTS); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 206| 0| return 0; 207| 0| } 208| 722| return ec_GFp_simple_oct2point(group, point, buf, len, ctx); 209| 722|} EC_POINT_point2oct: 213| 1.02k| size_t max_out, BN_CTX *ctx) { 214| 1.02k| if (EC_GROUP_cmp(group, point->group, NULL) != 0) { ------------------ | Branch (214:7): [True: 0, False: 1.02k] ------------------ 215| 0| OPENSSL_PUT_ERROR(EC, EC_R_INCOMPATIBLE_OBJECTS); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 216| 0| return 0; 217| 0| } 218| 1.02k| if (buf == NULL) { ------------------ | Branch (218:7): [True: 514, False: 514] ------------------ 219| | // When |buf| is NULL, just return the number of bytes that would be 220| | // written, without doing an expensive Jacobian-to-affine conversion. 221| 514| if (ec_GFp_simple_is_at_infinity(group, &point->raw)) { ------------------ | Branch (221:9): [True: 0, False: 514] ------------------ 222| 0| OPENSSL_PUT_ERROR(EC, EC_R_POINT_AT_INFINITY); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 223| 0| return 0; 224| 0| } 225| 514| return ec_point_byte_len(group, form); 226| 514| } 227| 514| EC_AFFINE affine; 228| 514| if (!ec_jacobian_to_affine(group, &affine, &point->raw)) { ------------------ | Branch (228:7): [True: 0, False: 514] ------------------ 229| 0| return 0; 230| 0| } 231| 514| return ec_point_to_bytes(group, &affine, form, buf, max_out); 232| 514|} EC_POINT_set_compressed_coordinates_GFp: 257| 671| int y_bit, BN_CTX *ctx) { 258| 671| if (EC_GROUP_cmp(group, point->group, NULL) != 0) { ------------------ | Branch (258:7): [True: 0, False: 671] ------------------ 259| 0| OPENSSL_PUT_ERROR(EC, EC_R_INCOMPATIBLE_OBJECTS); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 260| 0| return 0; 261| 0| } 262| | 263| 671| if (BN_is_negative(x) || BN_cmp(x, &group->field) >= 0) { ------------------ | Branch (263:7): [True: 0, False: 671] | Branch (263:28): [True: 0, False: 671] ------------------ 264| 0| OPENSSL_PUT_ERROR(EC, EC_R_INVALID_COMPRESSED_POINT); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 265| 0| return 0; 266| 0| } 267| | 268| 671| BN_CTX *new_ctx = NULL; 269| 671| int ret = 0; 270| | 271| 671| ERR_clear_error(); 272| | 273| 671| if (ctx == NULL) { ------------------ | Branch (273:7): [True: 0, False: 671] ------------------ 274| 0| ctx = new_ctx = BN_CTX_new(); 275| 0| if (ctx == NULL) { ------------------ | Branch (275:9): [True: 0, False: 0] ------------------ 276| 0| return 0; 277| 0| } 278| 0| } 279| | 280| 671| y_bit = (y_bit != 0); 281| | 282| 671| BN_CTX_start(ctx); 283| 671| BIGNUM *tmp1 = BN_CTX_get(ctx); 284| 671| BIGNUM *tmp2 = BN_CTX_get(ctx); 285| 671| BIGNUM *a = BN_CTX_get(ctx); 286| 671| BIGNUM *b = BN_CTX_get(ctx); 287| 671| BIGNUM *y = BN_CTX_get(ctx); 288| 671| if (y == NULL || ------------------ | Branch (288:7): [True: 0, False: 671] ------------------ 289| 671| !EC_GROUP_get_curve_GFp(group, NULL, a, b, ctx)) { ------------------ | Branch (289:7): [True: 0, False: 671] ------------------ 290| 0| goto err; 291| 0| } 292| | 293| | // Recover y. We have a Weierstrass equation 294| | // y^2 = x^3 + a*x + b, 295| | // so y is one of the square roots of x^3 + a*x + b. 296| | 297| | // tmp1 := x^3 298| 671| if (!BN_mod_sqr(tmp2, x, &group->field, ctx) || ------------------ | Branch (298:7): [True: 0, False: 671] ------------------ 299| 671| !BN_mod_mul(tmp1, tmp2, x, &group->field, ctx)) { ------------------ | Branch (299:7): [True: 0, False: 671] ------------------ 300| 0| goto err; 301| 0| } 302| | 303| | // tmp1 := tmp1 + a*x 304| 671| if (group->a_is_minus3) { ------------------ | Branch (304:7): [True: 671, False: 0] ------------------ 305| 671| if (!bn_mod_lshift1_consttime(tmp2, x, &group->field, ctx) || ------------------ | Branch (305:9): [True: 0, False: 671] ------------------ 306| 671| !bn_mod_add_consttime(tmp2, tmp2, x, &group->field, ctx) || ------------------ | Branch (306:9): [True: 0, False: 671] ------------------ 307| 671| !bn_mod_sub_consttime(tmp1, tmp1, tmp2, &group->field, ctx)) { ------------------ | Branch (307:9): [True: 0, False: 671] ------------------ 308| 0| goto err; 309| 0| } 310| 671| } else { 311| 0| if (!BN_mod_mul(tmp2, a, x, &group->field, ctx) || ------------------ | Branch (311:9): [True: 0, False: 0] ------------------ 312| 0| !bn_mod_add_consttime(tmp1, tmp1, tmp2, &group->field, ctx)) { ------------------ | Branch (312:9): [True: 0, False: 0] ------------------ 313| 0| goto err; 314| 0| } 315| 0| } 316| | 317| | // tmp1 := tmp1 + b 318| 671| if (!bn_mod_add_consttime(tmp1, tmp1, b, &group->field, ctx)) { ------------------ | Branch (318:7): [True: 0, False: 671] ------------------ 319| 0| goto err; 320| 0| } 321| | 322| 671| if (!BN_mod_sqrt(y, tmp1, &group->field, ctx)) { ------------------ | Branch (322:7): [True: 160, False: 511] ------------------ 323| 160| uint32_t err = ERR_peek_last_error(); 324| 160| if (ERR_GET_LIB(err) == ERR_LIB_BN && ------------------ | Branch (324:9): [True: 160, False: 0] ------------------ 325| 160| ERR_GET_REASON(err) == BN_R_NOT_A_SQUARE) { ------------------ | | 1076| 160|#define BN_R_NOT_A_SQUARE 110 ------------------ | Branch (325:9): [True: 160, False: 0] ------------------ 326| 160| ERR_clear_error(); 327| 160| OPENSSL_PUT_ERROR(EC, EC_R_INVALID_COMPRESSED_POINT); ------------------ | | 441| 160| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 328| 160| } else { 329| 0| OPENSSL_PUT_ERROR(EC, ERR_R_BN_LIB); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 330| 0| } 331| 160| goto err; 332| 160| } 333| | 334| 511| if (y_bit != BN_is_odd(y)) { ------------------ | Branch (334:7): [True: 313, False: 198] ------------------ 335| 313| if (BN_is_zero(y)) { ------------------ | Branch (335:9): [True: 0, False: 313] ------------------ 336| 0| OPENSSL_PUT_ERROR(EC, EC_R_INVALID_COMPRESSION_BIT); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 337| 0| goto err; 338| 0| } 339| 313| if (!BN_usub(y, &group->field, y)) { ------------------ | Branch (339:9): [True: 0, False: 313] ------------------ 340| 0| goto err; 341| 0| } 342| 313| } 343| 511| if (y_bit != BN_is_odd(y)) { ------------------ | Branch (343:7): [True: 0, False: 511] ------------------ 344| 0| OPENSSL_PUT_ERROR(EC, ERR_R_INTERNAL_ERROR); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 345| 0| goto err; 346| 0| } 347| | 348| 511| if (!EC_POINT_set_affine_coordinates_GFp(group, point, x, y, ctx)) { ------------------ | Branch (348:7): [True: 0, False: 511] ------------------ 349| 0| goto err; 350| 0| } 351| | 352| 511| ret = 1; 353| | 354| 671|err: 355| 671| BN_CTX_end(ctx); 356| 671| BN_CTX_free(new_ctx); 357| 671| return ret; 358| 511|} bcm.c:ec_GFp_simple_oct2point: 138| 722| BN_CTX *ctx) { 139| 722| if (len == 0) { ------------------ | Branch (139:7): [True: 4, False: 718] ------------------ 140| 4| OPENSSL_PUT_ERROR(EC, EC_R_BUFFER_TOO_SMALL); ------------------ | | 441| 4| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 141| 4| return 0; 142| 4| } 143| | 144| 718| point_conversion_form_t form = buf[0]; 145| 718| if (form == POINT_CONVERSION_UNCOMPRESSED) { ------------------ | Branch (145:7): [True: 21, False: 697] ------------------ 146| 21| EC_AFFINE affine; 147| 21| if (!ec_point_from_uncompressed(group, &affine, buf, len)) { ------------------ | Branch (147:9): [True: 18, False: 3] ------------------ 148| | // In the event of an error, defend against the caller not checking the 149| | // return value by setting a known safe value. 150| 18| ec_set_to_safe_point(group, &point->raw); 151| 18| return 0; 152| 18| } 153| 3| ec_affine_to_jacobian(group, &point->raw, &affine); 154| 3| return 1; 155| 21| } 156| | 157| 697| const int y_bit = form & 1; 158| 697| const size_t field_len = BN_num_bytes(&group->field); 159| 697| form = form & ~1u; 160| 697| if (form != POINT_CONVERSION_COMPRESSED || ------------------ | Branch (160:7): [True: 9, False: 688] ------------------ 161| 697| len != 1 /* type byte */ + field_len) { ------------------ | Branch (161:7): [True: 14, False: 674] ------------------ 162| 23| OPENSSL_PUT_ERROR(EC, EC_R_INVALID_ENCODING); ------------------ | | 441| 23| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 163| 23| return 0; 164| 23| } 165| | 166| | // TODO(davidben): Integrate compressed coordinates with the lower-level EC 167| | // abstractions. This requires a way to compute square roots, which is tricky 168| | // for primes which are not 3 (mod 4), namely P-224 and custom curves. P-224's 169| | // prime is particularly inconvenient for compressed coordinates. See 170| | // https://cr.yp.to/papers/sqroot.pdf 171| 674| BN_CTX *new_ctx = NULL; 172| 674| if (ctx == NULL) { ------------------ | Branch (172:7): [True: 674, False: 0] ------------------ 173| 674| ctx = new_ctx = BN_CTX_new(); 174| 674| if (ctx == NULL) { ------------------ | Branch (174:9): [True: 0, False: 674] ------------------ 175| 0| return 0; 176| 0| } 177| 674| } 178| | 179| 674| int ret = 0; 180| 674| BN_CTX_start(ctx); 181| 674| BIGNUM *x = BN_CTX_get(ctx); 182| 674| if (x == NULL || !BN_bin2bn(buf + 1, field_len, x)) { ------------------ | Branch (182:7): [True: 0, False: 674] | Branch (182:20): [True: 0, False: 674] ------------------ 183| 0| goto err; 184| 0| } 185| 674| if (BN_ucmp(x, &group->field) >= 0) { ------------------ | Branch (185:7): [True: 3, False: 671] ------------------ 186| 3| OPENSSL_PUT_ERROR(EC, EC_R_INVALID_ENCODING); ------------------ | | 441| 3| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 187| 3| goto err; 188| 3| } 189| | 190| 671| if (!EC_POINT_set_compressed_coordinates_GFp(group, point, x, y_bit, ctx)) { ------------------ | Branch (190:7): [True: 160, False: 511] ------------------ 191| 160| goto err; 192| 160| } 193| | 194| 511| ret = 1; 195| | 196| 674|err: 197| 674| BN_CTX_end(ctx); 198| 674| BN_CTX_free(new_ctx); 199| 674| return ret; 200| 511|} bcm.c:EC_GFp_nistp224_method_do_init: 1144| 1|DEFINE_METHOD_FUNCTION(EC_METHOD, EC_GFp_nistp224_method) { 1145| 1| out->group_init = ec_GFp_simple_group_init; 1146| 1| out->group_finish = ec_GFp_simple_group_finish; 1147| 1| out->group_set_curve = ec_GFp_simple_group_set_curve; 1148| 1| out->point_get_affine_coordinates = 1149| 1| ec_GFp_nistp224_point_get_affine_coordinates; 1150| 1| out->add = ec_GFp_nistp224_add; 1151| 1| out->dbl = ec_GFp_nistp224_dbl; 1152| 1| out->mul = ec_GFp_nistp224_point_mul; 1153| 1| out->mul_base = ec_GFp_nistp224_point_mul_base; 1154| 1| out->mul_public = ec_GFp_nistp224_point_mul_public; 1155| 1| out->felem_mul = ec_GFp_nistp224_felem_mul; 1156| 1| out->felem_sqr = ec_GFp_nistp224_felem_sqr; 1157| 1| out->felem_to_bytes = ec_GFp_simple_felem_to_bytes; 1158| 1| out->felem_from_bytes = ec_GFp_simple_felem_from_bytes; 1159| 1| out->scalar_inv0_montgomery = ec_simple_scalar_inv0_montgomery; 1160| 1| out->scalar_to_montgomery_inv_vartime = 1161| 1| ec_simple_scalar_to_montgomery_inv_vartime; 1162| 1| out->cmp_x_coordinate = ec_GFp_simple_cmp_x_coordinate; 1163| 1|} bcm.c:ec_GFp_nistp224_point_get_affine_coordinates: 864| 404| EC_FELEM *y) { 865| 404| if (constant_time_declassify_int( ------------------ | Branch (865:7): [True: 0, False: 404] ------------------ 866| 404| ec_GFp_simple_is_at_infinity(group, point))) { 867| 0| OPENSSL_PUT_ERROR(EC, EC_R_POINT_AT_INFINITY); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 868| 0| return 0; 869| 0| } 870| | 871| 404| p224_felem z1, z2; 872| 404| p224_widefelem tmp; 873| 404| p224_generic_to_felem(z1, &point->Z); 874| 404| p224_felem_inv(z2, z1); 875| 404| p224_felem_square(tmp, z2); 876| 404| p224_felem_reduce(z1, tmp); 877| | 878| 404| if (x != NULL) { ------------------ | Branch (878:7): [True: 404, False: 0] ------------------ 879| 404| p224_felem x_in, x_out; 880| 404| p224_generic_to_felem(x_in, &point->X); 881| 404| p224_felem_mul(tmp, x_in, z1); 882| 404| p224_felem_reduce(x_out, tmp); 883| 404| p224_felem_to_generic(x, x_out); 884| 404| } 885| | 886| 404| if (y != NULL) { ------------------ | Branch (886:7): [True: 404, False: 0] ------------------ 887| 404| p224_felem y_in, y_out; 888| 404| p224_generic_to_felem(y_in, &point->Y); 889| 404| p224_felem_mul(tmp, z1, z2); 890| 404| p224_felem_reduce(z1, tmp); 891| 404| p224_felem_mul(tmp, y_in, z1); 892| 404| p224_felem_reduce(y_out, tmp); 893| 404| p224_felem_to_generic(y, y_out); 894| 404| } 895| | 896| 404| return 1; 897| 404|} bcm.c:p224_generic_to_felem: 181| 2.83k|static void p224_generic_to_felem(p224_felem out, const EC_FELEM *in) { 182| | // |p224_felem|'s minimal representation uses four 56-bit words. |EC_FELEM| 183| | // uses four 64-bit words. (The top-most word only has 32 bits.) 184| 2.83k| out[0] = in->words[0] & 0x00ffffffffffffff; 185| 2.83k| out[1] = ((in->words[0] >> 56) | (in->words[1] << 8)) & 0x00ffffffffffffff; 186| 2.83k| out[2] = ((in->words[1] >> 48) | (in->words[2] << 16)) & 0x00ffffffffffffff; 187| 2.83k| out[3] = ((in->words[2] >> 40) | (in->words[3] << 24)) & 0x00ffffffffffffff; 188| 2.83k|} bcm.c:p224_felem_inv: 487| 404|static void p224_felem_inv(p224_felem out, const p224_felem in) { 488| 404| p224_felem ftmp, ftmp2, ftmp3, ftmp4; 489| 404| p224_widefelem tmp; 490| | 491| 404| p224_felem_square(tmp, in); 492| 404| p224_felem_reduce(ftmp, tmp); // 2 493| 404| p224_felem_mul(tmp, in, ftmp); 494| 404| p224_felem_reduce(ftmp, tmp); // 2^2 - 1 495| 404| p224_felem_square(tmp, ftmp); 496| 404| p224_felem_reduce(ftmp, tmp); // 2^3 - 2 497| 404| p224_felem_mul(tmp, in, ftmp); 498| 404| p224_felem_reduce(ftmp, tmp); // 2^3 - 1 499| 404| p224_felem_square(tmp, ftmp); 500| 404| p224_felem_reduce(ftmp2, tmp); // 2^4 - 2 501| 404| p224_felem_square(tmp, ftmp2); 502| 404| p224_felem_reduce(ftmp2, tmp); // 2^5 - 4 503| 404| p224_felem_square(tmp, ftmp2); 504| 404| p224_felem_reduce(ftmp2, tmp); // 2^6 - 8 505| 404| p224_felem_mul(tmp, ftmp2, ftmp); 506| 404| p224_felem_reduce(ftmp, tmp); // 2^6 - 1 507| 404| p224_felem_square(tmp, ftmp); 508| 404| p224_felem_reduce(ftmp2, tmp); // 2^7 - 2 509| 2.42k| for (size_t i = 0; i < 5; ++i) { // 2^12 - 2^6 ------------------ | Branch (509:22): [True: 2.02k, False: 404] ------------------ 510| 2.02k| p224_felem_square(tmp, ftmp2); 511| 2.02k| p224_felem_reduce(ftmp2, tmp); 512| 2.02k| } 513| 404| p224_felem_mul(tmp, ftmp2, ftmp); 514| 404| p224_felem_reduce(ftmp2, tmp); // 2^12 - 1 515| 404| p224_felem_square(tmp, ftmp2); 516| 404| p224_felem_reduce(ftmp3, tmp); // 2^13 - 2 517| 4.84k| for (size_t i = 0; i < 11; ++i) { // 2^24 - 2^12 ------------------ | Branch (517:22): [True: 4.44k, False: 404] ------------------ 518| 4.44k| p224_felem_square(tmp, ftmp3); 519| 4.44k| p224_felem_reduce(ftmp3, tmp); 520| 4.44k| } 521| 404| p224_felem_mul(tmp, ftmp3, ftmp2); 522| 404| p224_felem_reduce(ftmp2, tmp); // 2^24 - 1 523| 404| p224_felem_square(tmp, ftmp2); 524| 404| p224_felem_reduce(ftmp3, tmp); // 2^25 - 2 525| 9.69k| for (size_t i = 0; i < 23; ++i) { // 2^48 - 2^24 ------------------ | Branch (525:22): [True: 9.29k, False: 404] ------------------ 526| 9.29k| p224_felem_square(tmp, ftmp3); 527| 9.29k| p224_felem_reduce(ftmp3, tmp); 528| 9.29k| } 529| 404| p224_felem_mul(tmp, ftmp3, ftmp2); 530| 404| p224_felem_reduce(ftmp3, tmp); // 2^48 - 1 531| 404| p224_felem_square(tmp, ftmp3); 532| 404| p224_felem_reduce(ftmp4, tmp); // 2^49 - 2 533| 19.3k| for (size_t i = 0; i < 47; ++i) { // 2^96 - 2^48 ------------------ | Branch (533:22): [True: 18.9k, False: 404] ------------------ 534| 18.9k| p224_felem_square(tmp, ftmp4); 535| 18.9k| p224_felem_reduce(ftmp4, tmp); 536| 18.9k| } 537| 404| p224_felem_mul(tmp, ftmp3, ftmp4); 538| 404| p224_felem_reduce(ftmp3, tmp); // 2^96 - 1 539| 404| p224_felem_square(tmp, ftmp3); 540| 404| p224_felem_reduce(ftmp4, tmp); // 2^97 - 2 541| 9.69k| for (size_t i = 0; i < 23; ++i) { // 2^120 - 2^24 ------------------ | Branch (541:22): [True: 9.29k, False: 404] ------------------ 542| 9.29k| p224_felem_square(tmp, ftmp4); 543| 9.29k| p224_felem_reduce(ftmp4, tmp); 544| 9.29k| } 545| 404| p224_felem_mul(tmp, ftmp2, ftmp4); 546| 404| p224_felem_reduce(ftmp2, tmp); // 2^120 - 1 547| 2.82k| for (size_t i = 0; i < 6; ++i) { // 2^126 - 2^6 ------------------ | Branch (547:22): [True: 2.42k, False: 404] ------------------ 548| 2.42k| p224_felem_square(tmp, ftmp2); 549| 2.42k| p224_felem_reduce(ftmp2, tmp); 550| 2.42k| } 551| 404| p224_felem_mul(tmp, ftmp2, ftmp); 552| 404| p224_felem_reduce(ftmp, tmp); // 2^126 - 1 553| 404| p224_felem_square(tmp, ftmp); 554| 404| p224_felem_reduce(ftmp, tmp); // 2^127 - 2 555| 404| p224_felem_mul(tmp, ftmp, in); 556| 404| p224_felem_reduce(ftmp, tmp); // 2^127 - 1 557| 39.5k| for (size_t i = 0; i < 97; ++i) { // 2^224 - 2^97 ------------------ | Branch (557:22): [True: 39.1k, False: 404] ------------------ 558| 39.1k| p224_felem_square(tmp, ftmp); 559| 39.1k| p224_felem_reduce(ftmp, tmp); 560| 39.1k| } 561| 404| p224_felem_mul(tmp, ftmp, ftmp3); 562| 404| p224_felem_reduce(out, tmp); // 2^224 - 2^96 - 1 563| 404|} bcm.c:p224_felem_square: 364| 91.3k|static void p224_felem_square(p224_widefelem out, const p224_felem in) { 365| 91.3k| p224_limb tmp0, tmp1, tmp2; 366| 91.3k| tmp0 = 2 * in[0]; 367| 91.3k| tmp1 = 2 * in[1]; 368| 91.3k| tmp2 = 2 * in[2]; 369| 91.3k| out[0] = ((p224_widelimb)in[0]) * in[0]; 370| 91.3k| out[1] = ((p224_widelimb)in[0]) * tmp1; 371| 91.3k| out[2] = ((p224_widelimb)in[0]) * tmp2 + ((p224_widelimb)in[1]) * in[1]; 372| 91.3k| out[3] = ((p224_widelimb)in[3]) * tmp0 + ((p224_widelimb)in[1]) * tmp2; 373| 91.3k| out[4] = ((p224_widelimb)in[3]) * tmp1 + ((p224_widelimb)in[2]) * in[2]; 374| 91.3k| out[5] = ((p224_widelimb)in[3]) * tmp2; 375| 91.3k| out[6] = ((p224_widelimb)in[3]) * in[3]; 376| 91.3k|} bcm.c:p224_felem_reduce: 396| 97.3k|static void p224_felem_reduce(p224_felem out, const p224_widefelem in) { 397| 97.3k| static const p224_widelimb two127p15 = 398| 97.3k| (((p224_widelimb)1) << 127) + (((p224_widelimb)1) << 15); 399| 97.3k| static const p224_widelimb two127m71 = 400| 97.3k| (((p224_widelimb)1) << 127) - (((p224_widelimb)1) << 71); 401| 97.3k| static const p224_widelimb two127m71m55 = (((p224_widelimb)1) << 127) - 402| 97.3k| (((p224_widelimb)1) << 71) - 403| 97.3k| (((p224_widelimb)1) << 55); 404| 97.3k| p224_widelimb output[5]; 405| | 406| | // Add 0 mod 2^224-2^96+1 to ensure all differences are positive 407| 97.3k| output[0] = in[0] + two127p15; 408| 97.3k| output[1] = in[1] + two127m71m55; 409| 97.3k| output[2] = in[2] + two127m71; 410| 97.3k| output[3] = in[3]; 411| 97.3k| output[4] = in[4]; 412| | 413| | // Eliminate in[4], in[5], in[6] 414| 97.3k| output[4] += in[6] >> 16; 415| 97.3k| output[3] += (in[6] & 0xffff) << 40; 416| 97.3k| output[2] -= in[6]; 417| | 418| 97.3k| output[3] += in[5] >> 16; 419| 97.3k| output[2] += (in[5] & 0xffff) << 40; 420| 97.3k| output[1] -= in[5]; 421| | 422| 97.3k| output[2] += output[4] >> 16; 423| 97.3k| output[1] += (output[4] & 0xffff) << 40; 424| 97.3k| output[0] -= output[4]; 425| | 426| | // Carry 2 -> 3 -> 4 427| 97.3k| output[3] += output[2] >> 56; 428| 97.3k| output[2] &= 0x00ffffffffffffff; 429| | 430| 97.3k| output[4] = output[3] >> 56; 431| 97.3k| output[3] &= 0x00ffffffffffffff; 432| | 433| | // Now output[2] < 2^56, output[3] < 2^56, output[4] < 2^72 434| | 435| | // Eliminate output[4] 436| 97.3k| output[2] += output[4] >> 16; 437| | // output[2] < 2^56 + 2^56 = 2^57 438| 97.3k| output[1] += (output[4] & 0xffff) << 40; 439| 97.3k| output[0] -= output[4]; 440| | 441| | // Carry 0 -> 1 -> 2 -> 3 442| 97.3k| output[1] += output[0] >> 56; 443| 97.3k| out[0] = output[0] & 0x00ffffffffffffff; 444| | 445| 97.3k| output[2] += output[1] >> 56; 446| | // output[2] < 2^57 + 2^72 447| 97.3k| out[1] = output[1] & 0x00ffffffffffffff; 448| 97.3k| output[3] += output[2] >> 56; 449| | // output[3] <= 2^56 + 2^16 450| 97.3k| out[2] = output[2] & 0x00ffffffffffffff; 451| | 452| | // out[0] < 2^56, out[1] < 2^56, out[2] < 2^56, 453| | // out[3] <= 2^56 + 2^16 (due to final carry), 454| | // so out < 2*p 455| 97.3k| out[3] = output[3]; 456| 97.3k|} bcm.c:p224_felem_mul: 380| 6.06k| const p224_felem in2) { 381| 6.06k| out[0] = ((p224_widelimb)in1[0]) * in2[0]; 382| 6.06k| out[1] = ((p224_widelimb)in1[0]) * in2[1] + ((p224_widelimb)in1[1]) * in2[0]; 383| 6.06k| out[2] = ((p224_widelimb)in1[0]) * in2[2] + ((p224_widelimb)in1[1]) * in2[1] + 384| 6.06k| ((p224_widelimb)in1[2]) * in2[0]; 385| 6.06k| out[3] = ((p224_widelimb)in1[0]) * in2[3] + ((p224_widelimb)in1[1]) * in2[2] + 386| 6.06k| ((p224_widelimb)in1[2]) * in2[1] + ((p224_widelimb)in1[3]) * in2[0]; 387| 6.06k| out[4] = ((p224_widelimb)in1[1]) * in2[3] + ((p224_widelimb)in1[2]) * in2[2] + 388| 6.06k| ((p224_widelimb)in1[3]) * in2[1]; 389| 6.06k| out[5] = ((p224_widelimb)in1[2]) * in2[3] + ((p224_widelimb)in1[3]) * in2[2]; 390| 6.06k| out[6] = ((p224_widelimb)in1[3]) * in2[3]; 391| 6.06k|} bcm.c:p224_felem_to_generic: 191| 2.02k|static void p224_felem_to_generic(EC_FELEM *out, const p224_felem in) { 192| | // Reduce to unique minimal representation. 193| 2.02k| static const int64_t two56 = ((p224_limb)1) << 56; 194| | // 0 <= in < 2*p, p = 2^224 - 2^96 + 1 195| | // if in > p , reduce in = in - 2^224 + 2^96 - 1 196| 2.02k| int64_t tmp[4], a; 197| 2.02k| tmp[0] = in[0]; 198| 2.02k| tmp[1] = in[1]; 199| 2.02k| tmp[2] = in[2]; 200| 2.02k| tmp[3] = in[3]; 201| | // Case 1: a = 1 iff in >= 2^224 202| 2.02k| a = (in[3] >> 56); 203| 2.02k| tmp[0] -= a; 204| 2.02k| tmp[1] += a << 40; 205| 2.02k| tmp[3] &= 0x00ffffffffffffff; 206| | // Case 2: a = 0 iff p <= in < 2^224, i.e., the high 128 bits are all 1 and 207| | // the lower part is non-zero 208| 2.02k| a = ((in[3] & in[2] & (in[1] | 0x000000ffffffffff)) + 1) | 209| 2.02k| (((int64_t)(in[0] + (in[1] & 0x000000ffffffffff)) - 1) >> 63); 210| 2.02k| a &= 0x00ffffffffffffff; 211| | // turn a into an all-one mask (if a = 0) or an all-zero mask 212| 2.02k| a = (a - 1) >> 63; 213| | // subtract 2^224 - 2^96 + 1 if a is all-one 214| 2.02k| tmp[3] &= a ^ 0xffffffffffffffff; 215| 2.02k| tmp[2] &= a ^ 0xffffffffffffffff; 216| 2.02k| tmp[1] &= (a ^ 0xffffffffffffffff) | 0x000000ffffffffff; 217| 2.02k| tmp[0] -= 1 & a; 218| | 219| | // eliminate negative coefficients: if tmp[0] is negative, tmp[1] must 220| | // be non-zero, so we only need one step 221| 2.02k| a = tmp[0] >> 63; 222| 2.02k| tmp[0] += two56 & a; 223| 2.02k| tmp[1] -= 1 & a; 224| | 225| | // carry 1 -> 2 -> 3 226| 2.02k| tmp[2] += tmp[1] >> 56; 227| 2.02k| tmp[1] &= 0x00ffffffffffffff; 228| | 229| 2.02k| tmp[3] += tmp[2] >> 56; 230| 2.02k| tmp[2] &= 0x00ffffffffffffff; 231| | 232| | // Now 0 <= tmp < p 233| 2.02k| p224_felem tmp2; 234| 2.02k| tmp2[0] = tmp[0]; 235| 2.02k| tmp2[1] = tmp[1]; 236| 2.02k| tmp2[2] = tmp[2]; 237| 2.02k| tmp2[3] = tmp[3]; 238| | 239| | // |p224_felem|'s minimal representation uses four 56-bit words. |EC_FELEM| 240| | // uses four 64-bit words. (The top-most word only has 32 bits.) 241| 2.02k| out->words[0] = tmp2[0] | (tmp2[1] << 56); 242| 2.02k| out->words[1] = (tmp2[1] >> 8) | (tmp2[2] << 48); 243| 2.02k| out->words[2] = (tmp2[2] >> 16) | (tmp2[3] << 40); 244| 2.02k| out->words[3] = tmp2[3] >> 24; 245| 2.02k|} bcm.c:ec_GFp_nistp224_felem_mul: 1124| 406| const EC_FELEM *a, const EC_FELEM *b) { 1125| 406| p224_felem felem1, felem2; 1126| 406| p224_widefelem wide; 1127| 406| p224_generic_to_felem(felem1, a); 1128| 406| p224_generic_to_felem(felem2, b); 1129| 406| p224_felem_mul(wide, felem1, felem2); 1130| 406| p224_felem_reduce(felem1, wide); 1131| 406| p224_felem_to_generic(r, felem1); 1132| 406|} bcm.c:ec_GFp_nistp224_felem_sqr: 1135| 812| const EC_FELEM *a) { 1136| 812| p224_felem felem; 1137| 812| p224_generic_to_felem(felem, a); 1138| 812| p224_widefelem wide; 1139| 812| p224_felem_square(wide, felem); 1140| 812| p224_felem_reduce(felem, wide); 1141| 812| p224_felem_to_generic(r, felem); 1142| 812|} bcm.c:EC_GFp_nistz256_method_do_init: 615| 1|DEFINE_METHOD_FUNCTION(EC_METHOD, EC_GFp_nistz256_method) { 616| 1| out->group_init = ec_GFp_mont_group_init; 617| 1| out->group_finish = ec_GFp_mont_group_finish; 618| 1| out->group_set_curve = ec_GFp_mont_group_set_curve; 619| 1| out->point_get_affine_coordinates = ecp_nistz256_get_affine; 620| 1| out->add = ecp_nistz256_add; 621| 1| out->dbl = ecp_nistz256_dbl; 622| 1| out->mul = ecp_nistz256_point_mul; 623| 1| out->mul_base = ecp_nistz256_point_mul_base; 624| 1| out->mul_public = ecp_nistz256_points_mul_public; 625| 1| out->felem_mul = ec_GFp_mont_felem_mul; 626| 1| out->felem_sqr = ec_GFp_mont_felem_sqr; 627| 1| out->felem_to_bytes = ec_GFp_mont_felem_to_bytes; 628| 1| out->felem_from_bytes = ec_GFp_mont_felem_from_bytes; 629| 1| out->felem_reduce = ec_GFp_mont_felem_reduce; 630| | // TODO(davidben): This should use the specialized field arithmetic 631| | // implementation, rather than the generic one. 632| 1| out->felem_exp = ec_GFp_mont_felem_exp; 633| 1| out->scalar_inv0_montgomery = ecp_nistz256_inv0_mod_ord; 634| 1| out->scalar_to_montgomery_inv_vartime = 635| 1| ecp_nistz256_scalar_to_montgomery_inv_vartime; 636| 1| out->cmp_x_coordinate = ecp_nistz256_cmp_x_coordinate; 637| 1|} bcm.c:ecp_nistz256_get_affine: 424| 67| EC_FELEM *y) { 425| 67| if (constant_time_declassify_int( ------------------ | Branch (425:7): [True: 0, False: 67] ------------------ 426| 67| ec_GFp_simple_is_at_infinity(group, point))) { 427| 0| OPENSSL_PUT_ERROR(EC, EC_R_POINT_AT_INFINITY); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 428| 0| return 0; 429| 0| } 430| | 431| 67| BN_ULONG z_inv2[P256_LIMBS]; 432| 67| assert(group->field.width == P256_LIMBS); 433| 67| ecp_nistz256_mod_inverse_sqr_mont(z_inv2, point->Z.words); 434| | 435| 67| if (x != NULL) { ------------------ | Branch (435:7): [True: 67, False: 0] ------------------ 436| 67| ecp_nistz256_mul_mont(x->words, z_inv2, point->X.words); 437| 67| } 438| | 439| 67| if (y != NULL) { ------------------ | Branch (439:7): [True: 67, False: 0] ------------------ 440| 67| ecp_nistz256_sqr_mont(z_inv2, z_inv2); // z^-4 441| 67| ecp_nistz256_mul_mont(y->words, point->Y.words, point->Z.words); // y * z 442| 67| ecp_nistz256_mul_mont(y->words, y->words, z_inv2); // y * z^-3 443| 67| } 444| | 445| 67| return 1; 446| 67|} bcm.c:ecp_nistz256_mod_inverse_sqr_mont: 123| 67| const BN_ULONG in[P256_LIMBS]) { 124| | // This implements the addition chain described in 125| | // https://briansmith.org/ecc-inversion-addition-chains-01#p256_field_inversion 126| 67| BN_ULONG x2[P256_LIMBS], x3[P256_LIMBS], x6[P256_LIMBS], x12[P256_LIMBS], 127| 67| x15[P256_LIMBS], x30[P256_LIMBS], x32[P256_LIMBS]; 128| 67| ecp_nistz256_sqr_mont(x2, in); // 2^2 - 2^1 129| 67| ecp_nistz256_mul_mont(x2, x2, in); // 2^2 - 2^0 130| | 131| 67| ecp_nistz256_sqr_mont(x3, x2); // 2^3 - 2^1 132| 67| ecp_nistz256_mul_mont(x3, x3, in); // 2^3 - 2^0 133| | 134| 67| ecp_nistz256_sqr_mont(x6, x3); 135| 201| for (int i = 1; i < 3; i++) { ------------------ | Branch (135:19): [True: 134, False: 67] ------------------ 136| 134| ecp_nistz256_sqr_mont(x6, x6); 137| 134| } // 2^6 - 2^3 138| 67| ecp_nistz256_mul_mont(x6, x6, x3); // 2^6 - 2^0 139| | 140| 67| ecp_nistz256_sqr_mont(x12, x6); 141| 402| for (int i = 1; i < 6; i++) { ------------------ | Branch (141:19): [True: 335, False: 67] ------------------ 142| 335| ecp_nistz256_sqr_mont(x12, x12); 143| 335| } // 2^12 - 2^6 144| 67| ecp_nistz256_mul_mont(x12, x12, x6); // 2^12 - 2^0 145| | 146| 67| ecp_nistz256_sqr_mont(x15, x12); 147| 201| for (int i = 1; i < 3; i++) { ------------------ | Branch (147:19): [True: 134, False: 67] ------------------ 148| 134| ecp_nistz256_sqr_mont(x15, x15); 149| 134| } // 2^15 - 2^3 150| 67| ecp_nistz256_mul_mont(x15, x15, x3); // 2^15 - 2^0 151| | 152| 67| ecp_nistz256_sqr_mont(x30, x15); 153| 1.00k| for (int i = 1; i < 15; i++) { ------------------ | Branch (153:19): [True: 938, False: 67] ------------------ 154| 938| ecp_nistz256_sqr_mont(x30, x30); 155| 938| } // 2^30 - 2^15 156| 67| ecp_nistz256_mul_mont(x30, x30, x15); // 2^30 - 2^0 157| | 158| 67| ecp_nistz256_sqr_mont(x32, x30); 159| 67| ecp_nistz256_sqr_mont(x32, x32); // 2^32 - 2^2 160| 67| ecp_nistz256_mul_mont(x32, x32, x2); // 2^32 - 2^0 161| | 162| 67| BN_ULONG ret[P256_LIMBS]; 163| 67| ecp_nistz256_sqr_mont(ret, x32); 164| 2.14k| for (int i = 1; i < 31 + 1; i++) { ------------------ | Branch (164:19): [True: 2.07k, False: 67] ------------------ 165| 2.07k| ecp_nistz256_sqr_mont(ret, ret); 166| 2.07k| } // 2^64 - 2^32 167| 67| ecp_nistz256_mul_mont(ret, ret, in); // 2^64 - 2^32 + 2^0 168| | 169| 8.64k| for (int i = 0; i < 96 + 32; i++) { ------------------ | Branch (169:19): [True: 8.57k, False: 67] ------------------ 170| 8.57k| ecp_nistz256_sqr_mont(ret, ret); 171| 8.57k| } // 2^192 - 2^160 + 2^128 172| 67| ecp_nistz256_mul_mont(ret, ret, x32); // 2^192 - 2^160 + 2^128 + 2^32 - 2^0 173| | 174| 2.21k| for (int i = 0; i < 32; i++) { ------------------ | Branch (174:19): [True: 2.14k, False: 67] ------------------ 175| 2.14k| ecp_nistz256_sqr_mont(ret, ret); 176| 2.14k| } // 2^224 - 2^192 + 2^160 + 2^64 - 2^32 177| 67| ecp_nistz256_mul_mont(ret, ret, x32); // 2^224 - 2^192 + 2^160 + 2^64 - 2^0 178| | 179| 2.07k| for (int i = 0; i < 30; i++) { ------------------ | Branch (179:19): [True: 2.01k, False: 67] ------------------ 180| 2.01k| ecp_nistz256_sqr_mont(ret, ret); 181| 2.01k| } // 2^254 - 2^222 + 2^190 + 2^94 - 2^30 182| 67| ecp_nistz256_mul_mont(ret, ret, x30); // 2^254 - 2^222 + 2^190 + 2^94 - 2^0 183| | 184| 67| ecp_nistz256_sqr_mont(ret, ret); 185| 67| ecp_nistz256_sqr_mont(r, ret); // 2^256 - 2^224 + 2^192 + 2^96 - 2^2 186| 67|} ec_GFp_simple_group_init: 91| 4|int ec_GFp_simple_group_init(EC_GROUP *group) { 92| 4| BN_init(&group->field); 93| 4| group->a_is_minus3 = 0; 94| 4| return 1; 95| 4|} ec_GFp_simple_group_set_curve: 103| 4| BN_CTX *ctx) { 104| | // p must be a prime > 3 105| 4| if (BN_num_bits(p) <= 2 || !BN_is_odd(p)) { ------------------ | Branch (105:7): [True: 0, False: 4] | Branch (105:30): [True: 0, False: 4] ------------------ 106| 0| OPENSSL_PUT_ERROR(EC, EC_R_INVALID_FIELD); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 107| 0| return 0; 108| 0| } 109| | 110| 4| int ret = 0; 111| 4| BN_CTX_start(ctx); 112| 4| BIGNUM *tmp = BN_CTX_get(ctx); 113| 4| if (tmp == NULL) { ------------------ | Branch (113:7): [True: 0, False: 4] ------------------ 114| 0| goto err; 115| 0| } 116| | 117| | // group->field 118| 4| if (!BN_copy(&group->field, p)) { ------------------ | Branch (118:7): [True: 0, False: 4] ------------------ 119| 0| goto err; 120| 0| } 121| 4| BN_set_negative(&group->field, 0); 122| | // Store the field in minimal form, so it can be used with |BN_ULONG| arrays. 123| 4| bn_set_minimal_width(&group->field); 124| | 125| 4| if (!ec_bignum_to_felem(group, &group->a, a) || ------------------ | Branch (125:7): [True: 0, False: 4] ------------------ 126| 4| !ec_bignum_to_felem(group, &group->b, b) || ------------------ | Branch (126:7): [True: 0, False: 4] ------------------ 127| 4| !ec_bignum_to_felem(group, &group->one, BN_value_one())) { ------------------ | Branch (127:7): [True: 0, False: 4] ------------------ 128| 0| goto err; 129| 0| } 130| | 131| | // group->a_is_minus3 132| 4| if (!BN_copy(tmp, a) || ------------------ | Branch (132:7): [True: 0, False: 4] ------------------ 133| 4| !BN_add_word(tmp, 3)) { ------------------ | Branch (133:7): [True: 0, False: 4] ------------------ 134| 0| goto err; 135| 0| } 136| 4| group->a_is_minus3 = (0 == BN_cmp(tmp, &group->field)); 137| | 138| 4| ret = 1; 139| | 140| 4|err: 141| 4| BN_CTX_end(ctx); 142| 4| return ret; 143| 4|} ec_GFp_simple_group_get_curve: 146| 671| BIGNUM *b) { 147| 671| if ((p != NULL && !BN_copy(p, &group->field)) || ------------------ | Branch (147:8): [True: 0, False: 671] | Branch (147:21): [True: 0, False: 0] ------------------ 148| 671| (a != NULL && !ec_felem_to_bignum(group, a, &group->a)) || ------------------ | Branch (148:8): [True: 671, False: 0] | Branch (148:21): [True: 0, False: 671] ------------------ 149| 671| (b != NULL && !ec_felem_to_bignum(group, b, &group->b))) { ------------------ | Branch (149:8): [True: 671, False: 0] | Branch (149:21): [True: 0, False: 671] ------------------ 150| 0| return 0; 151| 0| } 152| 671| return 1; 153| 671|} ec_GFp_simple_point_init: 155| 1.24k|void ec_GFp_simple_point_init(EC_JACOBIAN *point) { 156| 1.24k| OPENSSL_memset(&point->X, 0, sizeof(EC_FELEM)); 157| 1.24k| OPENSSL_memset(&point->Y, 0, sizeof(EC_FELEM)); 158| 1.24k| OPENSSL_memset(&point->Z, 0, sizeof(EC_FELEM)); 159| 1.24k|} ec_GFp_simple_point_copy: 161| 532|void ec_GFp_simple_point_copy(EC_JACOBIAN *dest, const EC_JACOBIAN *src) { 162| 532| OPENSSL_memcpy(&dest->X, &src->X, sizeof(EC_FELEM)); 163| 532| OPENSSL_memcpy(&dest->Y, &src->Y, sizeof(EC_FELEM)); 164| 532| OPENSSL_memcpy(&dest->Z, &src->Z, sizeof(EC_FELEM)); 165| 532|} ec_GFp_simple_is_at_infinity: 179| 1.02k| const EC_JACOBIAN *point) { 180| 1.02k| return ec_felem_non_zero_mask(group, &point->Z) == 0; 181| 1.02k|} ec_GFp_simple_felem_to_bytes: 331| 2.37k| size_t *out_len, const EC_FELEM *in) { 332| 2.37k| size_t len = BN_num_bytes(&group->field); 333| 2.37k| bn_words_to_big_endian(out, len, in->words, group->field.width); 334| 2.37k| *out_len = len; 335| 2.37k|} ec_GFp_simple_felem_from_bytes: 338| 1.05k| const uint8_t *in, size_t len) { 339| 1.05k| if (len != BN_num_bytes(&group->field)) { ------------------ | Branch (339:7): [True: 0, False: 1.05k] ------------------ 340| 0| OPENSSL_PUT_ERROR(EC, EC_R_DECODE_ERROR); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 341| 0| return 0; 342| 0| } 343| | 344| 1.05k| bn_big_endian_to_words(out->words, group->field.width, in, len); 345| | 346| 1.05k| if (!bn_less_than_words(out->words, group->field.d, group->field.width)) { ------------------ | Branch (346:7): [True: 5, False: 1.05k] ------------------ 347| 5| OPENSSL_PUT_ERROR(EC, EC_R_DECODE_ERROR); ------------------ | | 441| 5| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 348| 5| return 0; 349| 5| } 350| | 351| 1.05k| return 1; 352| 1.05k|} RSA_new: 206| 351|RSA *RSA_new(void) { return RSA_new_method(NULL); } RSA_new_method: 208| 351|RSA *RSA_new_method(const ENGINE *engine) { 209| 351| RSA *rsa = OPENSSL_malloc(sizeof(RSA)); 210| 351| if (rsa == NULL) { ------------------ | Branch (210:7): [True: 0, False: 351] ------------------ 211| 0| return NULL; 212| 0| } 213| | 214| 351| OPENSSL_memset(rsa, 0, sizeof(RSA)); 215| | 216| 351| if (engine) { ------------------ | Branch (216:7): [True: 0, False: 351] ------------------ 217| 0| rsa->meth = ENGINE_get_RSA_method(engine); 218| 0| } 219| | 220| 351| if (rsa->meth == NULL) { ------------------ | Branch (220:7): [True: 351, False: 0] ------------------ 221| 351| rsa->meth = (RSA_METHOD *) RSA_default_method(); 222| 351| } 223| 351| METHOD_ref(rsa->meth); 224| | 225| 351| rsa->references = 1; 226| 351| rsa->flags = rsa->meth->flags; 227| 351| CRYPTO_MUTEX_init(&rsa->lock); 228| 351| CRYPTO_new_ex_data(&rsa->ex_data); 229| | 230| 351| if (rsa->meth->init && !rsa->meth->init(rsa)) { ------------------ | Branch (230:7): [True: 0, False: 351] | Branch (230:26): [True: 0, False: 0] ------------------ 231| 0| CRYPTO_free_ex_data(g_rsa_ex_data_class_bss_get(), rsa, &rsa->ex_data); 232| 0| CRYPTO_MUTEX_cleanup(&rsa->lock); 233| 0| METHOD_unref(rsa->meth); 234| 0| OPENSSL_free(rsa); 235| 0| return NULL; 236| 0| } 237| | 238| 351| return rsa; 239| 351|} RSA_free: 252| 1.01k|void RSA_free(RSA *rsa) { 253| 1.01k| if (rsa == NULL) { ------------------ | Branch (253:7): [True: 662, False: 351] ------------------ 254| 662| return; 255| 662| } 256| | 257| 351| if (!CRYPTO_refcount_dec_and_test_zero(&rsa->references)) { ------------------ | Branch (257:7): [True: 0, False: 351] ------------------ 258| 0| return; 259| 0| } 260| | 261| 351| if (rsa->meth->finish) { ------------------ | Branch (261:7): [True: 0, False: 351] ------------------ 262| 0| rsa->meth->finish(rsa); 263| 0| } 264| 351| METHOD_unref(rsa->meth); 265| | 266| 351| CRYPTO_free_ex_data(g_rsa_ex_data_class_bss_get(), rsa, &rsa->ex_data); 267| | 268| 351| BN_free(rsa->n); 269| 351| BN_free(rsa->e); 270| 351| BN_free(rsa->d); 271| 351| BN_free(rsa->p); 272| 351| BN_free(rsa->q); 273| 351| BN_free(rsa->dmp1); 274| 351| BN_free(rsa->dmq1); 275| 351| BN_free(rsa->iqmp); 276| 351| rsa_invalidate_key(rsa); 277| 351| CRYPTO_MUTEX_cleanup(&rsa->lock); 278| 351| OPENSSL_free(rsa); 279| 351|} RSA_is_opaque: 438| 335|int RSA_is_opaque(const RSA *rsa) { 439| 335| return rsa->meth && (rsa->meth->flags & RSA_FLAG_OPAQUE); ------------------ | | 661| 335|#define RSA_FLAG_OPAQUE 1 ------------------ | Branch (439:10): [True: 335, False: 0] | Branch (439:23): [True: 0, False: 335] ------------------ 440| 335|} RSA_check_key: 787| 335|int RSA_check_key(const RSA *key) { 788| | // TODO(davidben): RSA key initialization is spread across 789| | // |rsa_check_public_key|, |RSA_check_key|, |freeze_private_key|, and 790| | // |BN_MONT_CTX_set_locked| as a result of API issues. See 791| | // https://crbug.com/boringssl/316. As a result, we inconsistently check RSA 792| | // invariants. We should fix this and integrate that logic. 793| | 794| 335| if (RSA_is_opaque(key)) { ------------------ | Branch (794:7): [True: 0, False: 335] ------------------ 795| | // Opaque keys can't be checked. 796| 0| return 1; 797| 0| } 798| | 799| 335| if (!rsa_check_public_key(key)) { ------------------ | Branch (799:7): [True: 303, False: 32] ------------------ 800| 303| return 0; 801| 303| } 802| | 803| 32| if ((key->p != NULL) != (key->q != NULL)) { ------------------ | Branch (803:7): [True: 0, False: 32] ------------------ 804| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_ONLY_ONE_OF_P_Q_GIVEN); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 805| 0| return 0; 806| 0| } 807| | 808| | // |key->d| must be bounded by |key->n|. This ensures bounds on |RSA_bits| 809| | // translate to bounds on the running time of private key operations. 810| 32| if (key->d != NULL && ------------------ | Branch (810:7): [True: 0, False: 32] ------------------ 811| 32| (BN_is_negative(key->d) || BN_cmp(key->d, key->n) >= 0)) { ------------------ | Branch (811:8): [True: 0, False: 0] | Branch (811:34): [True: 0, False: 0] ------------------ 812| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_D_OUT_OF_RANGE); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 813| 0| return 0; 814| 0| } 815| | 816| 32| if (key->d == NULL || key->p == NULL) { ------------------ | Branch (816:7): [True: 32, False: 0] | Branch (816:25): [True: 0, False: 0] ------------------ 817| | // For a public key, or without p and q, there's nothing that can be 818| | // checked. 819| 32| return 1; 820| 32| } 821| | 822| 0| BN_CTX *ctx = BN_CTX_new(); 823| 0| if (ctx == NULL) { ------------------ | Branch (823:7): [True: 0, False: 0] ------------------ 824| 0| return 0; 825| 0| } 826| | 827| 0| BIGNUM tmp, de, pm1, qm1, dmp1, dmq1; 828| 0| int ok = 0; 829| 0| BN_init(&tmp); 830| 0| BN_init(&de); 831| 0| BN_init(&pm1); 832| 0| BN_init(&qm1); 833| 0| BN_init(&dmp1); 834| 0| BN_init(&dmq1); 835| | 836| | // Check that p * q == n. Before we multiply, we check that p and q are in 837| | // bounds, to avoid a DoS vector in |bn_mul_consttime| below. Note that 838| | // n was bound by |rsa_check_public_key|. This also implicitly checks p and q 839| | // are odd, which is a necessary condition for Montgomery reduction. 840| 0| if (BN_is_negative(key->p) || BN_cmp(key->p, key->n) >= 0 || ------------------ | Branch (840:7): [True: 0, False: 0] | Branch (840:33): [True: 0, False: 0] ------------------ 841| 0| BN_is_negative(key->q) || BN_cmp(key->q, key->n) >= 0) { ------------------ | Branch (841:7): [True: 0, False: 0] | Branch (841:33): [True: 0, False: 0] ------------------ 842| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_N_NOT_EQUAL_P_Q); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 843| 0| goto out; 844| 0| } 845| 0| if (!bn_mul_consttime(&tmp, key->p, key->q, ctx)) { ------------------ | Branch (845:7): [True: 0, False: 0] ------------------ 846| 0| OPENSSL_PUT_ERROR(RSA, ERR_LIB_BN); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 847| 0| goto out; 848| 0| } 849| 0| if (BN_cmp(&tmp, key->n) != 0) { ------------------ | Branch (849:7): [True: 0, False: 0] ------------------ 850| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_N_NOT_EQUAL_P_Q); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 851| 0| goto out; 852| 0| } 853| | 854| | // d must be an inverse of e mod the Carmichael totient, lcm(p-1, q-1), but it 855| | // may be unreduced because other implementations use the Euler totient. We 856| | // simply check that d * e is one mod p-1 and mod q-1. Note d and e were bound 857| | // by earlier checks in this function. 858| 0| if (!bn_usub_consttime(&pm1, key->p, BN_value_one()) || ------------------ | Branch (858:7): [True: 0, False: 0] ------------------ 859| 0| !bn_usub_consttime(&qm1, key->q, BN_value_one())) { ------------------ | Branch (859:7): [True: 0, False: 0] ------------------ 860| 0| OPENSSL_PUT_ERROR(RSA, ERR_LIB_BN); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 861| 0| goto out; 862| 0| } 863| 0| const unsigned pm1_bits = BN_num_bits(&pm1); 864| 0| const unsigned qm1_bits = BN_num_bits(&qm1); 865| 0| if (!bn_mul_consttime(&de, key->d, key->e, ctx) || ------------------ | Branch (865:7): [True: 0, False: 0] ------------------ 866| 0| !bn_div_consttime(NULL, &tmp, &de, &pm1, pm1_bits, ctx) || ------------------ | Branch (866:7): [True: 0, False: 0] ------------------ 867| 0| !bn_div_consttime(NULL, &de, &de, &qm1, qm1_bits, ctx)) { ------------------ | Branch (867:7): [True: 0, False: 0] ------------------ 868| 0| OPENSSL_PUT_ERROR(RSA, ERR_LIB_BN); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 869| 0| goto out; 870| 0| } 871| | 872| 0| if (!BN_is_one(&tmp) || !BN_is_one(&de)) { ------------------ | Branch (872:7): [True: 0, False: 0] | Branch (872:27): [True: 0, False: 0] ------------------ 873| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_D_E_NOT_CONGRUENT_TO_1); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 874| 0| goto out; 875| 0| } 876| | 877| 0| int has_crt_values = key->dmp1 != NULL; 878| 0| if (has_crt_values != (key->dmq1 != NULL) || ------------------ | Branch (878:7): [True: 0, False: 0] ------------------ 879| 0| has_crt_values != (key->iqmp != NULL)) { ------------------ | Branch (879:7): [True: 0, False: 0] ------------------ 880| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_INCONSISTENT_SET_OF_CRT_VALUES); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 881| 0| goto out; 882| 0| } 883| | 884| 0| if (has_crt_values) { ------------------ | Branch (884:7): [True: 0, False: 0] ------------------ 885| 0| int dmp1_ok, dmq1_ok, iqmp_ok; 886| 0| if (!check_mod_inverse(&dmp1_ok, key->e, key->dmp1, &pm1, pm1_bits, ctx) || ------------------ | Branch (886:9): [True: 0, False: 0] ------------------ 887| 0| !check_mod_inverse(&dmq1_ok, key->e, key->dmq1, &qm1, qm1_bits, ctx) || ------------------ | Branch (887:9): [True: 0, False: 0] ------------------ 888| | // |p| is odd, so |pm1| and |p| have the same bit width. If they didn't, 889| | // we only need a lower bound anyway. 890| 0| !check_mod_inverse(&iqmp_ok, key->q, key->iqmp, key->p, pm1_bits, ------------------ | Branch (890:9): [True: 0, False: 0] ------------------ 891| 0| ctx)) { 892| 0| OPENSSL_PUT_ERROR(RSA, ERR_LIB_BN); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 893| 0| goto out; 894| 0| } 895| | 896| 0| if (!dmp1_ok || !dmq1_ok || !iqmp_ok) { ------------------ | Branch (896:9): [True: 0, False: 0] | Branch (896:21): [True: 0, False: 0] | Branch (896:33): [True: 0, False: 0] ------------------ 897| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_CRT_VALUES_INCORRECT); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 898| 0| goto out; 899| 0| } 900| 0| } 901| | 902| 0| ok = 1; 903| | 904| 0|out: 905| 0| BN_free(&tmp); 906| 0| BN_free(&de); 907| 0| BN_free(&pm1); 908| 0| BN_free(&qm1); 909| 0| BN_free(&dmp1); 910| 0| BN_free(&dmq1); 911| 0| BN_CTX_free(ctx); 912| | 913| 0| return ok; 914| 0|} rsa_check_public_key: 76| 335|int rsa_check_public_key(const RSA *rsa) { 77| 335| if (rsa->n == NULL) { ------------------ | Branch (77:7): [True: 0, False: 335] ------------------ 78| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_VALUE_MISSING); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 79| 0| return 0; 80| 0| } 81| | 82| | // TODO(davidben): 16384-bit RSA is huge. Can we bring this down to a limit of 83| | // 8192-bit? 84| 335| unsigned n_bits = BN_num_bits(rsa->n); 85| 335| if (n_bits > 16 * 1024) { ------------------ | Branch (85:7): [True: 0, False: 335] ------------------ 86| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_MODULUS_TOO_LARGE); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 87| 0| return 0; 88| 0| } 89| | 90| | // TODO(crbug.com/boringssl/607): Raise this limit. 512-bit RSA was factored 91| | // in 1999. 92| 335| if (n_bits < 512) { ------------------ | Branch (92:7): [True: 141, False: 194] ------------------ 93| 141| OPENSSL_PUT_ERROR(RSA, RSA_R_KEY_SIZE_TOO_SMALL); ------------------ | | 441| 141| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 94| 141| return 0; 95| 141| } 96| | 97| | // RSA moduli must be positive and odd. In addition to being necessary for RSA 98| | // in general, we cannot setup Montgomery reduction with even moduli. 99| 194| if (!BN_is_odd(rsa->n) || BN_is_negative(rsa->n)) { ------------------ | Branch (99:7): [True: 5, False: 189] | Branch (99:29): [True: 0, False: 189] ------------------ 100| 5| OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_RSA_PARAMETERS); ------------------ | | 441| 5| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 101| 5| return 0; 102| 5| } 103| | 104| 189| static const unsigned kMaxExponentBits = 33; 105| 189| if (rsa->e != NULL) { ------------------ | Branch (105:7): [True: 189, False: 0] ------------------ 106| | // Reject e = 1, negative e, and even e. e must be odd to be relatively 107| | // prime with phi(n). 108| 189| unsigned e_bits = BN_num_bits(rsa->e); 109| 189| if (e_bits < 2 || BN_is_negative(rsa->e) || !BN_is_odd(rsa->e)) { ------------------ | Branch (109:9): [True: 1, False: 188] | Branch (109:23): [True: 0, False: 188] | Branch (109:49): [True: 92, False: 96] ------------------ 110| 93| OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_E_VALUE); ------------------ | | 441| 93| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 111| 93| return 0; 112| 93| } 113| 96| if (rsa->flags & RSA_FLAG_LARGE_PUBLIC_EXPONENT) { ------------------ | | 683| 96|#define RSA_FLAG_LARGE_PUBLIC_EXPONENT 0x80 ------------------ | Branch (113:9): [True: 0, False: 96] ------------------ 114| | // The caller has requested disabling DoS protections. Still, e must be 115| | // less than n. 116| 0| if (BN_ucmp(rsa->n, rsa->e) <= 0) { ------------------ | Branch (116:11): [True: 0, False: 0] ------------------ 117| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_E_VALUE); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 118| 0| return 0; 119| 0| } 120| 96| } else { 121| | // Mitigate DoS attacks by limiting the exponent size. 33 bits was chosen 122| | // as the limit based on the recommendations in [1] and [2]. Windows 123| | // CryptoAPI doesn't support values larger than 32 bits [3], so it is 124| | // unlikely that exponents larger than 32 bits are being used for anything 125| | // Windows commonly does. 126| | // 127| | // [1] https://www.imperialviolet.org/2012/03/16/rsae.html 128| | // [2] https://www.imperialviolet.org/2012/03/17/rsados.html 129| | // [3] https://msdn.microsoft.com/en-us/library/aa387685(VS.85).aspx 130| 96| if (e_bits > kMaxExponentBits) { ------------------ | Branch (130:11): [True: 64, False: 32] ------------------ 131| 64| OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_E_VALUE); ------------------ | | 441| 64| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 132| 64| return 0; 133| 64| } 134| | 135| | // The upper bound on |e_bits| and lower bound on |n_bits| imply e is 136| | // bounded by n. 137| 32| assert(BN_ucmp(rsa->n, rsa->e) > 0); 138| 32| } 139| 96| } else if (!(rsa->flags & RSA_FLAG_NO_PUBLIC_EXPONENT)) { ------------------ | | 677| 0|#define RSA_FLAG_NO_PUBLIC_EXPONENT 0x40 ------------------ | Branch (139:14): [True: 0, False: 0] ------------------ 140| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_VALUE_MISSING); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 141| 0| return 0; 142| 0| } 143| | 144| 32| return 1; 145| 189|} rsa_invalidate_key: 289| 351|void rsa_invalidate_key(RSA *rsa) { 290| 351| rsa->private_key_frozen = 0; 291| | 292| 351| BN_MONT_CTX_free(rsa->mont_n); 293| 351| rsa->mont_n = NULL; 294| 351| BN_MONT_CTX_free(rsa->mont_p); 295| 351| rsa->mont_p = NULL; 296| 351| BN_MONT_CTX_free(rsa->mont_q); 297| 351| rsa->mont_q = NULL; 298| | 299| 351| BN_free(rsa->d_fixed); 300| 351| rsa->d_fixed = NULL; 301| 351| BN_free(rsa->dmp1_fixed); 302| 351| rsa->dmp1_fixed = NULL; 303| 351| BN_free(rsa->dmq1_fixed); 304| 351| rsa->dmq1_fixed = NULL; 305| 351| BN_free(rsa->inv_small_mod_large_mont); 306| 351| rsa->inv_small_mod_large_mont = NULL; 307| | 308| 351| for (size_t i = 0; i < rsa->num_blindings; i++) { ------------------ | Branch (308:22): [True: 0, False: 351] ------------------ 309| 0| BN_BLINDING_free(rsa->blindings[i]); 310| 0| } 311| 351| OPENSSL_free(rsa->blindings); 312| 351| rsa->blindings = NULL; 313| 351| rsa->num_blindings = 0; 314| 351| OPENSSL_free(rsa->blindings_inuse); 315| 351| rsa->blindings_inuse = NULL; 316| 351| rsa->blinding_fork_generation = 0; 317| 351|} bcm.c:RSA_default_method_do_init: 1349| 1|DEFINE_METHOD_FUNCTION(RSA_METHOD, RSA_default_method) { 1350| | // All of the methods are NULL to make it easier for the compiler/linker to 1351| | // drop unused functions. The wrapper functions will select the appropriate 1352| | // |rsa_default_*| implementation. 1353| 1| OPENSSL_memset(out, 0, sizeof(RSA_METHOD)); 1354| 1| out->common.is_static = 1; 1355| 1|} cbb.c:OPENSSL_memset: 1055| 9.14k|static inline void *OPENSSL_memset(void *dst, int c, size_t n) { 1056| 9.14k| if (n == 0) { ------------------ | Branch (1056:7): [True: 0, False: 9.14k] ------------------ 1057| 0| return dst; 1058| 0| } 1059| | 1060| 9.14k| return memset(dst, c, n); 1061| 9.14k|} cbb.c:OPENSSL_memmove: 1047| 147|static inline void *OPENSSL_memmove(void *dst, const void *src, size_t n) { 1048| 147| if (n == 0) { ------------------ | Branch (1048:7): [True: 0, False: 147] ------------------ 1049| 0| return dst; 1050| 0| } 1051| | 1052| 147| return memmove(dst, src, n); 1053| 147|} cbb.c:OPENSSL_memcpy: 1039| 1.32k|static inline void *OPENSSL_memcpy(void *dst, const void *src, size_t n) { 1040| 1.32k| if (n == 0) { ------------------ | Branch (1040:7): [True: 0, False: 1.32k] ------------------ 1041| 0| return dst; 1042| 0| } 1043| | 1044| 1.32k| return memcpy(dst, src, n); 1045| 1.32k|} err.c:OPENSSL_memset: 1055| 52.8k|static inline void *OPENSSL_memset(void *dst, int c, size_t n) { 1056| 52.8k| if (n == 0) { ------------------ | Branch (1056:7): [True: 0, False: 52.8k] ------------------ 1057| 0| return dst; 1058| 0| } 1059| | 1060| 52.8k| return memset(dst, c, n); 1061| 52.8k|} evp.c:OPENSSL_memset: 1055| 1.61k|static inline void *OPENSSL_memset(void *dst, int c, size_t n) { 1056| 1.61k| if (n == 0) { ------------------ | Branch (1056:7): [True: 0, False: 1.61k] ------------------ 1057| 0| return dst; 1058| 0| } 1059| | 1060| 1.61k| return memset(dst, c, n); 1061| 1.61k|} evp_asn1.c:OPENSSL_memcmp: 1031| 2.24k|static inline int OPENSSL_memcmp(const void *s1, const void *s2, size_t n) { 1032| 2.24k| if (n == 0) { ------------------ | Branch (1032:7): [True: 0, False: 2.24k] ------------------ 1033| 0| return 0; 1034| 0| } 1035| | 1036| 2.24k| return memcmp(s1, s2, n); 1037| 2.24k|} p_ed25519_asn1.c:OPENSSL_memcpy: 1039| 1|static inline void *OPENSSL_memcpy(void *dst, const void *src, size_t n) { 1040| 1| if (n == 0) { ------------------ | Branch (1040:7): [True: 0, False: 1] ------------------ 1041| 0| return dst; 1042| 0| } 1043| | 1044| 1| return memcpy(dst, src, n); 1045| 1|} p_x25519_asn1.c:OPENSSL_memcpy: 1039| 1|static inline void *OPENSSL_memcpy(void *dst, const void *src, size_t n) { 1040| 1| if (n == 0) { ------------------ | Branch (1040:7): [True: 0, False: 1] ------------------ 1041| 0| return dst; 1042| 0| } 1043| | 1044| 1| return memcpy(dst, src, n); 1045| 1|} mem.c:OPENSSL_memset: 1055| 66.3k|static inline void *OPENSSL_memset(void *dst, int c, size_t n) { 1056| 66.3k| if (n == 0) { ------------------ | Branch (1056:7): [True: 0, False: 66.3k] ------------------ 1057| 0| return dst; 1058| 0| } 1059| | 1060| 66.3k| return memset(dst, c, n); 1061| 66.3k|} refcount.c:CRYPTO_atomic_load_u32: 626| 3.15k|OPENSSL_INLINE uint32_t CRYPTO_atomic_load_u32(CRYPTO_atomic_u32 *val) { 627| 3.15k| return atomic_load(val); 628| 3.15k|} refcount.c:CRYPTO_atomic_compare_exchange_weak_u32: 631| 3.15k| CRYPTO_atomic_u32 *val, uint32_t *expected, uint32_t desired) { 632| 3.15k| return atomic_compare_exchange_weak(val, expected, desired); 633| 3.15k|} thread_pthread.c:OPENSSL_memset: 1055| 1|static inline void *OPENSSL_memset(void *dst, int c, size_t n) { 1056| 1| if (n == 0) { ------------------ | Branch (1056:7): [True: 0, False: 1] ------------------ 1057| 0| return dst; 1058| 0| } 1059| | 1060| 1| return memset(dst, c, n); 1061| 1|} bcm.c:OPENSSL_memmove: 1047| 5.39k|static inline void *OPENSSL_memmove(void *dst, const void *src, size_t n) { 1048| 5.39k| if (n == 0) { ------------------ | Branch (1048:7): [True: 0, False: 5.39k] ------------------ 1049| 0| return dst; 1050| 0| } 1051| | 1052| 5.39k| return memmove(dst, src, n); 1053| 5.39k|} bcm.c:OPENSSL_memcpy: 1039| 102k|static inline void *OPENSSL_memcpy(void *dst, const void *src, size_t n) { 1040| 102k| if (n == 0) { ------------------ | Branch (1040:7): [True: 25.5k, False: 76.7k] ------------------ 1041| 25.5k| return dst; 1042| 25.5k| } 1043| | 1044| 76.7k| return memcpy(dst, src, n); 1045| 102k|} bcm.c:constant_time_is_zero_w: 427| 22.4k|static inline crypto_word_t constant_time_is_zero_w(crypto_word_t a) { 428| | // Here is an SMT-LIB verification of this formula: 429| | // 430| | // (define-fun is_zero ((a (_ BitVec 32))) (_ BitVec 32) 431| | // (bvand (bvnot a) (bvsub a #x00000001)) 432| | // ) 433| | // 434| | // (declare-fun a () (_ BitVec 32)) 435| | // 436| | // (assert (not (= (= #x00000001 (bvlshr (is_zero a) #x0000001f)) (= a #x00000000)))) 437| | // (check-sat) 438| | // (get-model) 439| 22.4k| return constant_time_msb_w(~a & (a - 1)); 440| 22.4k|} bcm.c:constant_time_msb_w: 368| 43.1k|static inline crypto_word_t constant_time_msb_w(crypto_word_t a) { 369| 43.1k| return 0u - (a >> (sizeof(a) * 8 - 1)); 370| 43.1k|} bcm.c:constant_time_eq_w: 450| 20.6k| crypto_word_t b) { 451| 20.6k| return constant_time_is_zero_w(a ^ b); 452| 20.6k|} bcm.c:constant_time_select_w: 477| 1.56M| crypto_word_t b) { 478| | // Clang recognizes this pattern as a select. While it usually transforms it 479| | // to a cmov, it sometimes further transforms it into a branch, which we do 480| | // not want. 481| | // 482| | // Hiding the value of the mask from the compiler evades this transformation. 483| 1.56M| mask = value_barrier_w(mask); 484| 1.56M| return (mask & a) | (~mask & b); 485| 1.56M|} bcm.c:value_barrier_w: 340| 1.56M|static inline crypto_word_t value_barrier_w(crypto_word_t a) { 341| 1.56M|#if defined(__GNUC__) || defined(__clang__) 342| 1.56M| __asm__("" : "+r"(a) : /* no inputs */); 343| 1.56M|#endif 344| 1.56M| return a; 345| 1.56M|} bcm.c:OPENSSL_memset: 1055| 3.14M|static inline void *OPENSSL_memset(void *dst, int c, size_t n) { 1056| 3.14M| if (n == 0) { ------------------ | Branch (1056:7): [True: 1.05M, False: 2.08M] ------------------ 1057| 1.05M| return dst; 1058| 1.05M| } 1059| | 1060| 2.08M| return memset(dst, c, n); 1061| 3.14M|} bcm.c:CRYPTO_load_word_be: 1122| 15.1k|static inline crypto_word_t CRYPTO_load_word_be(const void *in) { 1123| 15.1k| crypto_word_t v; 1124| 15.1k| OPENSSL_memcpy(&v, in, sizeof(v)); 1125| 15.1k|#if defined(OPENSSL_64_BIT) 1126| 15.1k| static_assert(sizeof(v) == 8, "crypto_word_t has unexpected size"); 1127| 15.1k| return CRYPTO_bswap8(v); 1128| |#else 1129| | static_assert(sizeof(v) == 4, "crypto_word_t has unexpected size"); 1130| | return CRYPTO_bswap4(v); 1131| |#endif 1132| 15.1k|} bcm.c:CRYPTO_bswap8: 949| 15.1k|static inline uint64_t CRYPTO_bswap8(uint64_t x) { 950| 15.1k| return __builtin_bswap64(x); 951| 15.1k|} bcm.c:constant_time_select_int: 503| 42.1k|static inline int constant_time_select_int(crypto_word_t mask, int a, int b) { 504| 42.1k| return (int)(constant_time_select_w(mask, (crypto_word_t)(a), 505| 42.1k| (crypto_word_t)(b))); 506| 42.1k|} bcm.c:constant_time_declassify_int: 572| 1.73k|static inline int constant_time_declassify_int(int v) { 573| 1.73k| static_assert(sizeof(uint32_t) == sizeof(int), 574| 1.73k| "int is not the same size as uint32_t"); 575| | // See comment above. 576| 1.73k| CONSTTIME_DECLASSIFY(&v, sizeof(v)); 577| 1.73k| return value_barrier_u32(v); 578| 1.73k|} bcm.c:value_barrier_u32: 348| 1.73k|static inline uint32_t value_barrier_u32(uint32_t a) { 349| 1.73k|#if defined(__GNUC__) || defined(__clang__) 350| 1.73k| __asm__("" : "+r"(a) : /* no inputs */); 351| 1.73k|#endif 352| 1.73k| return a; 353| 1.73k|} bcm.c:constant_time_lt_w: 374| 20.6k| crypto_word_t b) { 375| | // Consider the two cases of the problem: 376| | // msb(a) == msb(b): a < b iff the MSB of a - b is set. 377| | // msb(a) != msb(b): a < b iff the MSB of b is set. 378| | // 379| | // If msb(a) == msb(b) then the following evaluates as: 380| | // msb(a^((a^b)|((a-b)^a))) == 381| | // msb(a^((a-b) ^ a)) == (because msb(a^b) == 0) 382| | // msb(a^a^(a-b)) == (rearranging) 383| | // msb(a-b) (because ∀x. x^x == 0) 384| | // 385| | // Else, if msb(a) != msb(b) then the following evaluates as: 386| | // msb(a^((a^b)|((a-b)^a))) == 387| | // msb(a^(𝟙 | ((a-b)^a))) == (because msb(a^b) == 1 and 𝟙 388| | // represents a value s.t. msb(𝟙) = 1) 389| | // msb(a^𝟙) == (because ORing with 1 results in 1) 390| | // msb(b) 391| | // 392| | // 393| | // Here is an SMT-LIB verification of this formula: 394| | // 395| | // (define-fun lt ((a (_ BitVec 32)) (b (_ BitVec 32))) (_ BitVec 32) 396| | // (bvxor a (bvor (bvxor a b) (bvxor (bvsub a b) a))) 397| | // ) 398| | // 399| | // (declare-fun a () (_ BitVec 32)) 400| | // (declare-fun b () (_ BitVec 32)) 401| | // 402| | // (assert (not (= (= #x00000001 (bvlshr (lt a b) #x0000001f)) (bvult a b)))) 403| | // (check-sat) 404| | // (get-model) 405| 20.6k| return constant_time_msb_w(a^((a^b)|((a-b)^a))); 406| 20.6k|} dsa.c:OPENSSL_memset: 1055| 463|static inline void *OPENSSL_memset(void *dst, int c, size_t n) { 1056| 463| if (n == 0) { ------------------ | Branch (1056:7): [True: 0, False: 463] ------------------ 1057| 0| return dst; 1058| 0| } 1059| | 1060| 463| return memset(dst, c, n); 1061| 463|} ec_asn1.c:OPENSSL_memcmp: 1031| 1.94k|static inline int OPENSSL_memcmp(const void *s1, const void *s2, size_t n) { 1032| 1.94k| if (n == 0) { ------------------ | Branch (1032:7): [True: 0, False: 1.94k] ------------------ 1033| 0| return 0; 1034| 0| } 1035| | 1036| 1.94k| return memcmp(s1, s2, n); 1037| 1.94k|} stack.c:OPENSSL_memset: 1055| 1.36k|static inline void *OPENSSL_memset(void *dst, int c, size_t n) { 1056| 1.36k| if (n == 0) { ------------------ | Branch (1056:7): [True: 0, False: 1.36k] ------------------ 1057| 0| return dst; 1058| 0| } 1059| | 1060| 1.36k| return memset(dst, c, n); 1061| 1.36k|} OPENSSL_malloc: 228| 65.8k|void *OPENSSL_malloc(size_t size) { 229| 65.8k| if (should_fail_allocation()) { ------------------ | Branch (229:7): [True: 0, False: 65.8k] ------------------ 230| 0| goto err; 231| 0| } 232| | 233| 65.8k| if (OPENSSL_memory_alloc != NULL) { ------------------ | Branch (233:7): [True: 0, False: 65.8k] ------------------ 234| 0| assert(OPENSSL_memory_free != NULL); 235| 0| assert(OPENSSL_memory_get_size != NULL); 236| 0| void *ptr = OPENSSL_memory_alloc(size); 237| 0| if (ptr == NULL && size != 0) { ------------------ | Branch (237:9): [True: 0, False: 0] | Branch (237:24): [True: 0, False: 0] ------------------ 238| 0| goto err; 239| 0| } 240| 0| return ptr; 241| 0| } 242| | 243| 65.8k| if (size + OPENSSL_MALLOC_PREFIX < size) { ------------------ | | 83| 65.8k|#define OPENSSL_MALLOC_PREFIX 8 ------------------ | Branch (243:7): [True: 0, False: 65.8k] ------------------ 244| | // |OPENSSL_malloc| is a central function in BoringSSL thus a reference to 245| | // |kBoringSSLBinaryTag| is created here so that the tag isn't discarded by 246| | // the linker. The following is sufficient to stop GCC, Clang, and MSVC 247| | // optimising away the reference at the time of writing. Since this 248| | // probably results in an actual memory reference, it is put in this very 249| | // rare code path. 250| 0| uint8_t unused = *(volatile uint8_t *)kBoringSSLBinaryTag; 251| 0| (void) unused; 252| 0| goto err; 253| 0| } 254| | 255| 65.8k| void *ptr = malloc(size + OPENSSL_MALLOC_PREFIX); ------------------ | | 83| 65.8k|#define OPENSSL_MALLOC_PREFIX 8 ------------------ 256| 65.8k| if (ptr == NULL) { ------------------ | Branch (256:7): [True: 0, False: 65.8k] ------------------ 257| 0| goto err; 258| 0| } 259| | 260| 65.8k| *(size_t *)ptr = size; 261| | 262| 65.8k| __asan_poison_memory_region(ptr, OPENSSL_MALLOC_PREFIX); ------------------ | | 83| 65.8k|#define OPENSSL_MALLOC_PREFIX 8 ------------------ 263| 65.8k| return ((uint8_t *)ptr) + OPENSSL_MALLOC_PREFIX; ------------------ | | 83| 65.8k|#define OPENSSL_MALLOC_PREFIX 8 ------------------ 264| | 265| 0| err: 266| | // This only works because ERR does not call OPENSSL_malloc. 267| 0| OPENSSL_PUT_ERROR(CRYPTO, ERR_R_MALLOC_FAILURE); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 268| 0| return NULL; 269| 65.8k|} OPENSSL_free: 271| 89.2k|void OPENSSL_free(void *orig_ptr) { 272| 89.2k| if (orig_ptr == NULL) { ------------------ | Branch (272:7): [True: 23.4k, False: 65.8k] ------------------ 273| 23.4k| return; 274| 23.4k| } 275| | 276| 65.8k| if (OPENSSL_memory_free != NULL) { ------------------ | Branch (276:7): [True: 0, False: 65.8k] ------------------ 277| 0| OPENSSL_memory_free(orig_ptr); 278| 0| return; 279| 0| } 280| | 281| 65.8k| void *ptr = ((uint8_t *)orig_ptr) - OPENSSL_MALLOC_PREFIX; ------------------ | | 83| 65.8k|#define OPENSSL_MALLOC_PREFIX 8 ------------------ 282| 65.8k| __asan_unpoison_memory_region(ptr, OPENSSL_MALLOC_PREFIX); ------------------ | | 83| 65.8k|#define OPENSSL_MALLOC_PREFIX 8 ------------------ 283| | 284| 65.8k| size_t size = *(size_t *)ptr; 285| 65.8k| OPENSSL_cleanse(ptr, size + OPENSSL_MALLOC_PREFIX); ------------------ | | 83| 65.8k|#define OPENSSL_MALLOC_PREFIX 8 ------------------ 286| | 287| |// ASan knows to intercept malloc and free, but not sdallocx. 288| |#if defined(OPENSSL_ASAN) 289| | (void)sdallocx; 290| | free(ptr); 291| |#else 292| 65.8k| if (sdallocx) { ------------------ | Branch (292:7): [True: 0, False: 65.8k] ------------------ 293| 0| sdallocx(ptr, size + OPENSSL_MALLOC_PREFIX, 0 /* flags */); ------------------ | | 83| 0|#define OPENSSL_MALLOC_PREFIX 8 ------------------ 294| 65.8k| } else { 295| 65.8k| free(ptr); 296| 65.8k| } 297| 65.8k|#endif 298| 65.8k|} OPENSSL_realloc: 300| 8.16k|void *OPENSSL_realloc(void *orig_ptr, size_t new_size) { 301| 8.16k| if (orig_ptr == NULL) { ------------------ | Branch (301:7): [True: 682, False: 7.48k] ------------------ 302| 682| return OPENSSL_malloc(new_size); 303| 682| } 304| | 305| 7.48k| size_t old_size; 306| 7.48k| if (OPENSSL_memory_get_size != NULL) { ------------------ | Branch (306:7): [True: 0, False: 7.48k] ------------------ 307| 0| old_size = OPENSSL_memory_get_size(orig_ptr); 308| 7.48k| } else { 309| 7.48k| void *ptr = ((uint8_t *)orig_ptr) - OPENSSL_MALLOC_PREFIX; ------------------ | | 83| 7.48k|#define OPENSSL_MALLOC_PREFIX 8 ------------------ 310| 7.48k| __asan_unpoison_memory_region(ptr, OPENSSL_MALLOC_PREFIX); ------------------ | | 83| 7.48k|#define OPENSSL_MALLOC_PREFIX 8 ------------------ 311| 7.48k| old_size = *(size_t *)ptr; 312| 7.48k| __asan_poison_memory_region(ptr, OPENSSL_MALLOC_PREFIX); ------------------ | | 83| 7.48k|#define OPENSSL_MALLOC_PREFIX 8 ------------------ 313| 7.48k| } 314| | 315| 7.48k| void *ret = OPENSSL_malloc(new_size); 316| 7.48k| if (ret == NULL) { ------------------ | Branch (316:7): [True: 0, False: 7.48k] ------------------ 317| 0| return NULL; 318| 0| } 319| | 320| 7.48k| size_t to_copy = new_size; 321| 7.48k| if (old_size < to_copy) { ------------------ | Branch (321:7): [True: 7.48k, False: 0] ------------------ 322| 7.48k| to_copy = old_size; 323| 7.48k| } 324| | 325| 7.48k| memcpy(ret, orig_ptr, to_copy); 326| 7.48k| OPENSSL_free(orig_ptr); 327| | 328| 7.48k| return ret; 329| 7.48k|} OPENSSL_cleanse: 331| 66.3k|void OPENSSL_cleanse(void *ptr, size_t len) { 332| |#if defined(OPENSSL_WINDOWS) 333| | SecureZeroMemory(ptr, len); 334| |#else 335| 66.3k| OPENSSL_memset(ptr, 0, len); 336| | 337| 66.3k|#if !defined(OPENSSL_NO_ASM) 338| | /* As best as we can tell, this is sufficient to break any optimisations that 339| | might try to eliminate "superfluous" memsets. If there's an easy way to 340| | detect memset_s, it would be better to use that. */ 341| 66.3k| __asm__ __volatile__("" : : "r"(ptr) : "memory"); 342| 66.3k|#endif 343| 66.3k|#endif // !OPENSSL_NO_ASM 344| 66.3k|} CRYPTO_memcmp: 360| 526|int CRYPTO_memcmp(const void *in_a, const void *in_b, size_t len) { 361| 526| const uint8_t *a = in_a; 362| 526| const uint8_t *b = in_b; 363| 526| uint8_t x = 0; 364| | 365| 18.3k| for (size_t i = 0; i < len; i++) { ------------------ | Branch (365:22): [True: 17.8k, False: 526] ------------------ 366| 17.8k| x |= a[i] ^ b[i]; 367| 17.8k| } 368| | 369| 526| return x; 370| 526|} mem.c:should_fail_allocation: 225| 65.8k|static int should_fail_allocation(void) { return 0; } mem.c:__asan_poison_memory_region: 90| 73.3k|static void __asan_poison_memory_region(const void *addr, size_t size) {} mem.c:__asan_unpoison_memory_region: 91| 73.2k|static void __asan_unpoison_memory_region(const void *addr, size_t size) {} CRYPTO_refcount_inc: 31| 4|void CRYPTO_refcount_inc(CRYPTO_refcount_t *in_count) { 32| 4| CRYPTO_atomic_u32 *count = (CRYPTO_atomic_u32 *)in_count; 33| 4| uint32_t expected = CRYPTO_atomic_load_u32(count); 34| | 35| 4| while (expected != CRYPTO_REFCOUNT_MAX) { ------------------ | | 718| 4|#define CRYPTO_REFCOUNT_MAX 0xffffffff ------------------ | Branch (35:10): [True: 4, False: 0] ------------------ 36| 4| uint32_t new_value = expected + 1; 37| 4| if (CRYPTO_atomic_compare_exchange_weak_u32(count, &expected, new_value)) { ------------------ | Branch (37:9): [True: 4, False: 0] ------------------ 38| 4| break; 39| 4| } 40| 4| } 41| 4|} CRYPTO_refcount_dec_and_test_zero: 43| 3.15k|int CRYPTO_refcount_dec_and_test_zero(CRYPTO_refcount_t *in_count) { 44| 3.15k| CRYPTO_atomic_u32 *count = (CRYPTO_atomic_u32 *)in_count; 45| 3.15k| uint32_t expected = CRYPTO_atomic_load_u32(count); 46| | 47| 3.15k| for (;;) { 48| 3.15k| if (expected == 0) { ------------------ | Branch (48:9): [True: 0, False: 3.15k] ------------------ 49| 0| abort(); 50| 3.15k| } else if (expected == CRYPTO_REFCOUNT_MAX) { ------------------ | | 718| 3.15k|#define CRYPTO_REFCOUNT_MAX 0xffffffff ------------------ | Branch (50:16): [True: 0, False: 3.15k] ------------------ 51| 0| return 0; 52| 3.15k| } else { 53| 3.15k| const uint32_t new_value = expected - 1; 54| 3.15k| if (CRYPTO_atomic_compare_exchange_weak_u32(count, &expected, ------------------ | Branch (54:11): [True: 3.15k, False: 0] ------------------ 55| 3.15k| new_value)) { 56| 3.15k| return new_value == 0; 57| 3.15k| } 58| 3.15k| } 59| 3.15k| } 60| 3.15k|} RSA_parse_public_key: 90| 351|RSA *RSA_parse_public_key(CBS *cbs) { 91| 351| RSA *ret = RSA_new(); 92| 351| if (ret == NULL) { ------------------ | Branch (92:7): [True: 0, False: 351] ------------------ 93| 0| return NULL; 94| 0| } 95| 351| CBS child; 96| 351| if (!CBS_get_asn1(cbs, &child, CBS_ASN1_SEQUENCE) || ------------------ | | 222| 351|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED) | | ------------------ | | | | 196| 351|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT) | | | | ------------------ | | | | | | 193| 351|#define CBS_ASN1_TAG_SHIFT 24 | | | | ------------------ | | ------------------ ------------------ | Branch (96:7): [True: 3, False: 348] ------------------ 97| 351| !parse_integer(&child, &ret->n) || ------------------ | Branch (97:7): [True: 2, False: 346] ------------------ 98| 351| !parse_integer(&child, &ret->e) || ------------------ | Branch (98:7): [True: 10, False: 336] ------------------ 99| 351| CBS_len(&child) != 0) { ------------------ | Branch (99:7): [True: 1, False: 335] ------------------ 100| 16| OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_ENCODING); ------------------ | | 441| 16| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 101| 16| RSA_free(ret); 102| 16| return NULL; 103| 16| } 104| | 105| 335| if (!RSA_check_key(ret)) { ------------------ | Branch (105:7): [True: 303, False: 32] ------------------ 106| 303| OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_RSA_PARAMETERS); ------------------ | | 441| 303| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 107| 303| RSA_free(ret); 108| 303| return NULL; 109| 303| } 110| | 111| 32| return ret; 112| 335|} RSA_marshal_public_key: 126| 23|int RSA_marshal_public_key(CBB *cbb, const RSA *rsa) { 127| 23| CBB child; 128| 23| if (!CBB_add_asn1(cbb, &child, CBS_ASN1_SEQUENCE) || ------------------ | | 222| 23|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED) | | ------------------ | | | | 196| 23|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT) | | | | ------------------ | | | | | | 193| 23|#define CBS_ASN1_TAG_SHIFT 24 | | | | ------------------ | | ------------------ ------------------ | Branch (128:7): [True: 0, False: 23] ------------------ 129| 23| !marshal_integer(&child, rsa->n) || ------------------ | Branch (129:7): [True: 0, False: 23] ------------------ 130| 23| !marshal_integer(&child, rsa->e) || ------------------ | Branch (130:7): [True: 0, False: 23] ------------------ 131| 23| !CBB_flush(cbb)) { ------------------ | Branch (131:7): [True: 0, False: 23] ------------------ 132| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_ENCODE_ERROR); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 133| 0| return 0; 134| 0| } 135| 23| return 1; 136| 23|} rsa_asn1.c:parse_integer: 72| 694|static int parse_integer(CBS *cbs, BIGNUM **out) { 73| 694| assert(*out == NULL); 74| 694| *out = BN_new(); 75| 694| if (*out == NULL) { ------------------ | Branch (75:7): [True: 0, False: 694] ------------------ 76| 0| return 0; 77| 0| } 78| 694| return BN_parse_asn1_unsigned(cbs, *out); 79| 694|} rsa_asn1.c:marshal_integer: 81| 46|static int marshal_integer(CBB *cbb, BIGNUM *bn) { 82| 46| if (bn == NULL) { ------------------ | Branch (82:7): [True: 0, False: 46] ------------------ 83| | // An RSA object may be missing some components. 84| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_VALUE_MISSING); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 85| 0| return 0; 86| 0| } 87| 46| return BN_marshal_asn1(cbb, bn); 88| 46|} sk_new: 72| 682|_STACK *sk_new(OPENSSL_sk_cmp_func comp) { 73| 682| _STACK *ret = OPENSSL_malloc(sizeof(_STACK)); 74| 682| if (ret == NULL) { ------------------ | Branch (74:7): [True: 0, False: 682] ------------------ 75| 0| return NULL; 76| 0| } 77| 682| OPENSSL_memset(ret, 0, sizeof(_STACK)); 78| | 79| 682| ret->data = OPENSSL_malloc(sizeof(void *) * kMinSize); 80| 682| if (ret->data == NULL) { ------------------ | Branch (80:7): [True: 0, False: 682] ------------------ 81| 0| goto err; 82| 0| } 83| | 84| 682| OPENSSL_memset(ret->data, 0, sizeof(void *) * kMinSize); 85| | 86| 682| ret->comp = comp; 87| 682| ret->num_alloc = kMinSize; 88| | 89| 682| return ret; 90| | 91| 0|err: 92| 0| OPENSSL_free(ret); 93| 0| return NULL; 94| 682|} sk_new_null: 96| 682|_STACK *sk_new_null(void) { return sk_new(NULL); } sk_num: 98| 6.50M|size_t sk_num(const _STACK *sk) { 99| 6.50M| if (sk == NULL) { ------------------ | Branch (99:7): [True: 0, False: 6.50M] ------------------ 100| 0| return 0; 101| 0| } 102| 6.50M| return sk->num; 103| 6.50M|} sk_value: 114| 6.50M|void *sk_value(const _STACK *sk, size_t i) { 115| 6.50M| if (!sk || i >= sk->num) { ------------------ | Branch (115:7): [True: 0, False: 6.50M] | Branch (115:14): [True: 0, False: 6.50M] ------------------ 116| 0| return NULL; 117| 0| } 118| 6.50M| return sk->data[i]; 119| 6.50M|} sk_free: 128| 682|void sk_free(_STACK *sk) { 129| 682| if (sk == NULL) { ------------------ | Branch (129:7): [True: 0, False: 682] ------------------ 130| 0| return; 131| 0| } 132| 682| OPENSSL_free(sk->data); 133| 682| OPENSSL_free(sk); 134| 682|} sk_pop_free_ex: 137| 682| OPENSSL_sk_free_func free_func) { 138| 682| if (sk == NULL) { ------------------ | Branch (138:7): [True: 0, False: 682] ------------------ 139| 0| return; 140| 0| } 141| | 142| 17.0k| for (size_t i = 0; i < sk->num; i++) { ------------------ | Branch (142:22): [True: 16.4k, False: 682] ------------------ 143| 16.4k| if (sk->data[i] != NULL) { ------------------ | Branch (143:9): [True: 16.4k, False: 0] ------------------ 144| 16.4k| call_free_func(free_func, sk->data[i]); 145| 16.4k| } 146| 16.4k| } 147| 682| sk_free(sk); 148| 682|} sk_insert: 161| 16.4k|size_t sk_insert(_STACK *sk, void *p, size_t where) { 162| 16.4k| if (sk == NULL) { ------------------ | Branch (162:7): [True: 0, False: 16.4k] ------------------ 163| 0| return 0; 164| 0| } 165| | 166| 16.4k| if (sk->num >= INT_MAX) { ------------------ | Branch (166:7): [True: 0, False: 16.4k] ------------------ 167| 0| OPENSSL_PUT_ERROR(CRYPTO, ERR_R_OVERFLOW); ------------------ | | 441| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 168| 0| return 0; 169| 0| } 170| | 171| 16.4k| if (sk->num_alloc <= sk->num + 1) { ------------------ | Branch (171:7): [True: 2.02k, False: 14.3k] ------------------ 172| | // Attempt to double the size of the array. 173| 2.02k| size_t new_alloc = sk->num_alloc << 1; 174| 2.02k| size_t alloc_size = new_alloc * sizeof(void *); 175| 2.02k| void **data; 176| | 177| | // If the doubling overflowed, try to increment. 178| 2.02k| if (new_alloc < sk->num_alloc || alloc_size / sizeof(void *) != new_alloc) { ------------------ | Branch (178:9): [True: 0, False: 2.02k] | Branch (178:38): [True: 0, False: 2.02k] ------------------ 179| 0| new_alloc = sk->num_alloc + 1; 180| 0| alloc_size = new_alloc * sizeof(void *); 181| 0| } 182| | 183| | // If the increment also overflowed, fail. 184| 2.02k| if (new_alloc < sk->num_alloc || alloc_size / sizeof(void *) != new_alloc) { ------------------ | Branch (184:9): [True: 0, False: 2.02k] | Branch (184:38): [True: 0, False: 2.02k] ------------------ 185| 0| return 0; 186| 0| } 187| | 188| 2.02k| data = OPENSSL_realloc(sk->data, alloc_size); 189| 2.02k| if (data == NULL) { ------------------ | Branch (189:9): [True: 0, False: 2.02k] ------------------ 190| 0| return 0; 191| 0| } 192| | 193| 2.02k| sk->data = data; 194| 2.02k| sk->num_alloc = new_alloc; 195| 2.02k| } 196| | 197| 16.4k| if (where >= sk->num) { ------------------ | Branch (197:7): [True: 16.4k, False: 0] ------------------ 198| 16.4k| sk->data[sk->num] = p; 199| 16.4k| } else { 200| 0| OPENSSL_memmove(&sk->data[where + 1], &sk->data[where], 201| 0| sizeof(void *) * (sk->num - where)); 202| 0| sk->data[where] = p; 203| 0| } 204| | 205| 16.4k| sk->num++; 206| 16.4k| sk->sorted = 0; 207| | 208| 16.4k| return sk->num; 209| 16.4k|} sk_push: 340| 16.4k|size_t sk_push(_STACK *sk, void *p) { return (sk_insert(sk, p, sk->num)); } CRYPTO_MUTEX_init: 31| 814|void CRYPTO_MUTEX_init(CRYPTO_MUTEX *lock) { 32| 814| if (pthread_rwlock_init((pthread_rwlock_t *) lock, NULL) != 0) { ------------------ | Branch (32:7): [True: 0, False: 814] ------------------ 33| 0| abort(); 34| 0| } 35| 814|} CRYPTO_MUTEX_cleanup: 61| 814|void CRYPTO_MUTEX_cleanup(CRYPTO_MUTEX *lock) { 62| 814| pthread_rwlock_destroy((pthread_rwlock_t *) lock); 63| 814|} CRYPTO_STATIC_MUTEX_lock_read: 65| 723|void CRYPTO_STATIC_MUTEX_lock_read(struct CRYPTO_STATIC_MUTEX *lock) { 66| 723| if (pthread_rwlock_rdlock(&lock->lock) != 0) { ------------------ | Branch (66:7): [True: 0, False: 723] ------------------ 67| 0| abort(); 68| 0| } 69| 723|} CRYPTO_STATIC_MUTEX_lock_write: 71| 4|void CRYPTO_STATIC_MUTEX_lock_write(struct CRYPTO_STATIC_MUTEX *lock) { 72| 4| if (pthread_rwlock_wrlock(&lock->lock) != 0) { ------------------ | Branch (72:7): [True: 0, False: 4] ------------------ 73| 0| abort(); 74| 0| } 75| 4|} CRYPTO_STATIC_MUTEX_unlock_read: 77| 723|void CRYPTO_STATIC_MUTEX_unlock_read(struct CRYPTO_STATIC_MUTEX *lock) { 78| 723| if (pthread_rwlock_unlock(&lock->lock) != 0) { ------------------ | Branch (78:7): [True: 0, False: 723] ------------------ 79| 0| abort(); 80| 0| } 81| 723|} CRYPTO_STATIC_MUTEX_unlock_write: 83| 4|void CRYPTO_STATIC_MUTEX_unlock_write(struct CRYPTO_STATIC_MUTEX *lock) { 84| 4| if (pthread_rwlock_unlock(&lock->lock) != 0) { ------------------ | Branch (84:7): [True: 0, False: 4] ------------------ 85| 0| abort(); 86| 0| } 87| 4|} CRYPTO_once: 89| 8.17k|void CRYPTO_once(CRYPTO_once_t *once, void (*init)(void)) { 90| 8.17k| if (pthread_once(once, init) != 0) { ------------------ | Branch (90:7): [True: 0, False: 8.17k] ------------------ 91| 0| abort(); 92| 0| } 93| 8.17k|} CRYPTO_get_thread_local: 132| 5.83k|void *CRYPTO_get_thread_local(thread_local_data_t index) { 133| 5.83k| CRYPTO_once(&g_thread_local_init_once, thread_local_init); 134| 5.83k| if (!g_thread_local_key_created) { ------------------ | Branch (134:7): [True: 0, False: 5.83k] ------------------ 135| 0| return NULL; 136| 0| } 137| | 138| 5.83k| void **pointers = pthread_getspecific(g_thread_local_key); 139| 5.83k| if (pointers == NULL) { ------------------ | Branch (139:7): [True: 1, False: 5.82k] ------------------ 140| 1| return NULL; 141| 1| } 142| 5.82k| return pointers[index]; 143| 5.83k|} CRYPTO_set_thread_local: 146| 1| thread_local_destructor_t destructor) { 147| 1| CRYPTO_once(&g_thread_local_init_once, thread_local_init); 148| 1| if (!g_thread_local_key_created) { ------------------ | Branch (148:7): [True: 0, False: 1] ------------------ 149| 0| destructor(value); 150| 0| return 0; 151| 0| } 152| | 153| 1| void **pointers = pthread_getspecific(g_thread_local_key); 154| 1| if (pointers == NULL) { ------------------ | Branch (154:7): [True: 1, False: 0] ------------------ 155| 1| pointers = malloc(sizeof(void *) * NUM_OPENSSL_THREAD_LOCALS); 156| 1| if (pointers == NULL) { ------------------ | Branch (156:9): [True: 0, False: 1] ------------------ 157| 0| destructor(value); 158| 0| return 0; 159| 0| } 160| 1| OPENSSL_memset(pointers, 0, sizeof(void *) * NUM_OPENSSL_THREAD_LOCALS); 161| 1| if (pthread_setspecific(g_thread_local_key, pointers) != 0) { ------------------ | Branch (161:9): [True: 0, False: 1] ------------------ 162| 0| free(pointers); 163| 0| destructor(value); 164| 0| return 0; 165| 0| } 166| 1| } 167| | 168| 1| if (pthread_mutex_lock(&g_destructors_lock) != 0) { ------------------ | Branch (168:7): [True: 0, False: 1] ------------------ 169| 0| destructor(value); 170| 0| return 0; 171| 0| } 172| 1| g_destructors[index] = destructor; 173| 1| pthread_mutex_unlock(&g_destructors_lock); 174| | 175| 1| pointers[index] = value; 176| 1| return 1; 177| 1|} thread_pthread.c:thread_local_init: 127| 1|static void thread_local_init(void) { 128| 1| g_thread_local_key_created = 129| 1| pthread_key_create(&g_thread_local_key, thread_local_destructor) == 0; 130| 1|} LLVMFuzzerTestOneInput: 20| 2.31k|extern "C" int LLVMFuzzerTestOneInput(const uint8_t *buf, size_t len) { 21| 2.31k| CBS cbs; 22| 2.31k| CBS_init(&cbs, buf, len); 23| 2.31k| EVP_PKEY *pkey = EVP_parse_public_key(&cbs); 24| 2.31k| if (pkey == NULL) { ------------------ | Branch (24:7): [True: 1.50k, False: 808] ------------------ 25| 1.50k| ERR_clear_error(); 26| 1.50k| return 0; 27| 1.50k| } 28| | 29| 808| uint8_t *der; 30| 808| size_t der_len; 31| 808| CBB cbb; 32| 808| if (CBB_init(&cbb, 0) && ------------------ | Branch (32:7): [True: 808, False: 0] ------------------ 33| 808| EVP_marshal_public_key(&cbb, pkey) && ------------------ | Branch (33:7): [True: 808, False: 0] ------------------ 34| 808| CBB_finish(&cbb, &der, &der_len)) { ------------------ | Branch (34:7): [True: 808, False: 0] ------------------ 35| 808| OPENSSL_free(der); 36| 808| } 37| 808| CBB_cleanup(&cbb); 38| 808| EVP_PKEY_free(pkey); 39| 808| ERR_clear_error(); 40| 808| return 0; 41| 2.31k|} bcm.c:ERR_GET_LIB: 166| 160|OPENSSL_INLINE int ERR_GET_LIB(uint32_t packed_error) { 167| 160| return (int)((packed_error >> 24) & 0xff); 168| 160|} bcm.c:ERR_GET_REASON: 173| 160|OPENSSL_INLINE int ERR_GET_REASON(uint32_t packed_error) { 174| 160| return (int)(packed_error & 0xfff); 175| 160|} bcm.c:sk_BIGNUM_pop_free: 447| 682| sk_##name##_free_func free_func) { \ 448| 682| sk_pop_free_ex((_STACK *)sk, sk_##name##_call_free_func, \ 449| 682| (OPENSSL_sk_free_func)free_func); \ 450| 682| } \ bcm.c:sk_BIGNUM_call_free_func: 391| 16.4k| OPENSSL_sk_free_func free_func, void *ptr) { \ 392| 16.4k| ((sk_##name##_free_func)free_func)((ptrtype)ptr); \ 393| 16.4k| } \ bcm.c:sk_BIGNUM_new_null: 420| 682| OPENSSL_INLINE STACK_OF(name) *sk_##name##_new_null(void) { \ 421| 682| return (STACK_OF(name) *)sk_new_null(); \ 422| 682| } \ bcm.c:sk_BIGNUM_num: 424| 6.50M| OPENSSL_INLINE size_t sk_##name##_num(const STACK_OF(name) *sk) { \ 425| 6.50M| return sk_num((const _STACK *)sk); \ 426| 6.50M| } \ bcm.c:sk_BIGNUM_push: 483| 16.4k| OPENSSL_INLINE size_t sk_##name##_push(STACK_OF(name) *sk, ptrtype p) { \ 484| 16.4k| return sk_push((_STACK *)sk, (void *)p); \ 485| 16.4k| } \ bcm.c:sk_BIGNUM_value: 433| 6.50M| size_t i) { \ 434| 6.50M| return (ptrtype)sk_value((const _STACK *)sk, i); \ 435| 6.50M| } \