| commit | a24ab549e6ae246b391155d7bed3790ac0e07de2 | [log] [tgz] |
|---|---|---|
| author | David Benjamin <davidben@google.com> | Thu Mar 25 15:26:25 2021 -0400 |
| committer | Adam Langley <agl@google.com> | Mon Mar 29 16:27:23 2021 +0000 |
| tree | 36f6f3eec37f463f7cae40c09a5b04ce80be6431 | |
| parent | 139adff9b27eaf0bdaac664ec4c9a7db2fe3f920 [diff] |
Use an unsized helper for truncated SHA-512 variants. Although it is strictly fine to call SHA512_Final in SHA384_Final (array sizes in C parameters are purely decorational, according to the language), GCC 11 reportedly checks now and gets upset about the size mismatch. Use an unsized helper function so all our code matches the specified bounds. Unfortunately, the bounds in all the functions are a bit misleading because SHA512_Final really outputs based on sha->md_len (which Init function you called) rather than which Final function. I've fixed this places within a library where we mismatched and added asserts to the smaller functions. SHA512_Final is assert-less because I've seen lots of code use SHA384_Init / SHA512_Update / SHA512_Final. This doesn't fix the SHA256 variant since that is generated by a pile of macros in a multiply-included file. This is probably a good opportunity to make that code less macro-heavy. Update-Note: There is a small chance the asserts will trip something, but hopefully not since I've left SHA512_Final alone. Bug: 402 Change-Id: I4c9d579a63ee0a0dea103c19ef219c13bb9aa62c Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/46405 Reviewed-by: Adam Langley <agl@google.com>
BoringSSL is a fork of OpenSSL that is designed to meet Google's needs.
Although BoringSSL is an open source project, it is not intended for general use, as OpenSSL is. We don't recommend that third parties depend upon it. Doing so is likely to be frustrating because there are no guarantees of API or ABI stability.
Programs ship their own copies of BoringSSL when they use it and we update everything as needed when deciding to make API changes. This allows us to mostly avoid compromises in the name of compatibility. It works for us, but it may not work for you.
BoringSSL arose because Google used OpenSSL for many years in various ways and, over time, built up a large number of patches that were maintained while tracking upstream OpenSSL. As Google's product portfolio became more complex, more copies of OpenSSL sprung up and the effort involved in maintaining all these patches in multiple places was growing steadily.
Currently BoringSSL is the SSL library in Chrome/Chromium, Android (but it's not part of the NDK) and a number of other apps/programs.
Project links:
There are other files in this directory which might be helpful: