commit 75a1f23684e6f776d6081b1565f0cb1f04b0e288
author David Benjamin <davidben@google.com> Wed Oct 11 17:19:19 2017 -0400
committer CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Thu Oct 12 19:01:34 2017 +0000
tree 23f3598ca2b687c55e111ddf6fd45cc79738fc93
parent dbf12fc2ce1cac1af45f58cd3ec4302eed86566b

Have a bit more fun with Span.

Change-Id: Iba909603a72ec0d149d9898423c114304a5011fa
Reviewed-on: https://boringssl-review.googlesource.com/21644
Commit-Queue: David Benjamin <davidben@google.com>
CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
Reviewed-by: Steven Valdez <svaldez@google.com>

ssl/tls13_both.cc

diff --git a/ssl/tls13_both.cc b/ssl/tls13_both.cc
index 1e7bdf1..5796bf4 100644
--- a/ssl/tls13_both.cc
+++ b/ssl/tls13_both.cc
@@ -37,57 +37,55 @@
 // without being able to return application data.
 static const uint8_t kMaxKeyUpdates = 32;
 
-int tls13_get_cert_verify_signature_input(
-    SSL_HANDSHAKE *hs, uint8_t **out, size_t *out_len,
+bool tls13_get_cert_verify_signature_input(
+    SSL_HANDSHAKE *hs, Array<uint8_t> *out,
     enum ssl_cert_verify_context_t cert_verify_context) {
   ScopedCBB cbb;
   if (!CBB_init(cbb.get(), 64 + 33 + 1 + 2 * EVP_MAX_MD_SIZE)) {
     OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE);
-    return 0;
+    return false;
   }
 
   for (size_t i = 0; i < 64; i++) {
     if (!CBB_add_u8(cbb.get(), 0x20)) {
       OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE);
-      return 0;
+      return false;
     }
   }
 
-  const uint8_t *context;
-  size_t context_len;
+  Span<const char> context;
   if (cert_verify_context == ssl_cert_verify_server) {
-    // Include the NUL byte.
     static const char kContext[] = "TLS 1.3, server CertificateVerify";
-    context = (const uint8_t *)kContext;
-    context_len = sizeof(kContext);
+    context = kContext;
   } else if (cert_verify_context == ssl_cert_verify_client) {
     static const char kContext[] = "TLS 1.3, client CertificateVerify";
-    context = (const uint8_t *)kContext;
-    context_len = sizeof(kContext);
+    context = kContext;
   } else if (cert_verify_context == ssl_cert_verify_channel_id) {
     static const char kContext[] = "TLS 1.3, Channel ID";
-    context = (const uint8_t *)kContext;
-    context_len = sizeof(kContext);
+    context = kContext;
   } else {
     OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE);
-    return 0;
+    return false;
   }
 
-  if (!CBB_add_bytes(cbb.get(), context, context_len)) {
+  // Note |context| includes the NUL byte separator.
+  if (!CBB_add_bytes(cbb.get(),
+                     reinterpret_cast<const uint8_t *>(context.data()),
+                     context.size())) {
     OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE);
-    return 0;
+    return false;
   }
 
   uint8_t context_hash[EVP_MAX_MD_SIZE];
   size_t context_hash_len;
   if (!hs->transcript.GetHash(context_hash, &context_hash_len) ||
       !CBB_add_bytes(cbb.get(), context_hash, context_hash_len) ||
-      !CBB_finish(cbb.get(), out, out_len)) {
+      !CBBFinishArray(cbb.get(), out)) {
     OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE);
-    return 0;
+    return false;
   }
 
-  return 1;
+  return true;
 }
 
 int tls13_process_certificate(SSL_HANDSHAKE *hs, const SSLMessage &msg,
@@ -285,21 +283,18 @@
   }
   hs->new_session->peer_signature_algorithm = signature_algorithm;
 
-  uint8_t *input = NULL;
-  size_t input_len;
+  Array<uint8_t> input;
   if (!tls13_get_cert_verify_signature_input(
-          hs, &input, &input_len,
+          hs, &input,
           ssl->server ? ssl_cert_verify_client : ssl_cert_verify_server)) {
     ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
     return 0;
   }
-  UniquePtr<uint8_t> free_input(input);
 
-  int sig_ok = ssl_public_key_verify(ssl, CBS_data(&signature),
-                                     CBS_len(&signature), signature_algorithm,
-                                     hs->peer_pubkey.get(), input, input_len);
+  bool sig_ok = ssl_public_key_verify(ssl, signature, signature_algorithm,
+                                      hs->peer_pubkey.get(), input);
 #if defined(BORINGSSL_UNSAFE_FUZZER_MODE)
-  sig_ok = 1;
+  sig_ok = true;
   ERR_clear_error();
 #endif
   if (!sig_ok) {
@@ -441,18 +436,16 @@
     return ssl_private_key_failure;
   }
 
-  uint8_t *msg = NULL;
-  size_t msg_len;
+  Array<uint8_t> msg;
   if (!tls13_get_cert_verify_signature_input(
-          hs, &msg, &msg_len,
+          hs, &msg,
           ssl->server ? ssl_cert_verify_server : ssl_cert_verify_client)) {
     ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
     return ssl_private_key_failure;
   }
-  UniquePtr<uint8_t> free_msg(msg);
 
   enum ssl_private_key_result_t sign_result = ssl_private_key_sign(
-      hs, sig, &sig_len, max_sig_len, signature_algorithm, msg, msg_len);
+      hs, sig, &sig_len, max_sig_len, signature_algorithm, msg);
   if (sign_result != ssl_private_key_success) {
     return sign_result;
   }