diff -up openssl-1.1.1b/apps/asn1pars.c.sync openssl-1.1.1b/apps/asn1pars.c

--- openssl-1.1.1b/apps/asn1pars.c.sync	2019-02-26 15:15:30.000000000 +0100

+++ openssl-1.1.1b/apps/asn1pars.c	2019-05-03 08:55:51.532407003 +0200

@@ -170,17 +170,17 @@ int asn1parse_main(int argc, char **argv

     if (derfile && (derout = bio_open_default(derfile, 'w', FORMAT_ASN1)) == NULL)

         goto end;

+    if ((buf = BUF_MEM_new()) == NULL)

+        goto end;

     if (strictpem) {

-        if (PEM_read_bio(in, &name, &header, &str, &num) !=

-            1) {

+        if (PEM_read_bio(in, &name, &header, &str, &num) != 1) {

             BIO_printf(bio_err, "Error reading PEM file\n");

             ERR_print_errors(bio_err);

             goto end;

         }

+        buf->data = (char *)str;

+        buf->length = buf->max = num;

     } else {

-

-        if ((buf = BUF_MEM_new()) == NULL)

-            goto end;

         if (!BUF_MEM_grow(buf, BUFSIZ * 8))

             goto end;           /* Pre-allocate :-) */

@@ -303,8 +303,6 @@ int asn1parse_main(int argc, char **argv

     BUF_MEM_free(buf);

     OPENSSL_free(name);

     OPENSSL_free(header);

-    if (strictpem)

-        OPENSSL_free(str);

     ASN1_TYPE_free(at);

     sk_OPENSSL_STRING_free(osk);

     return ret;

diff -up openssl-1.1.1b/crypto/aes/asm/aesp8-ppc.pl.sync openssl-1.1.1b/crypto/aes/asm/aesp8-ppc.pl

--- openssl-1.1.1b/crypto/aes/asm/aesp8-ppc.pl.sync	2019-02-26 15:15:30.000000000 +0100

+++ openssl-1.1.1b/crypto/aes/asm/aesp8-ppc.pl	2019-05-03 08:55:51.551406676 +0200

@@ -1829,7 +1829,7 @@ Lctr32_enc8x_three:

 	stvx_u		$out1,$x10,$out

 	stvx_u		$out2,$x20,$out

 	addi		$out,$out,0x30

-	b		Lcbc_dec8x_done

+	b		Lctr32_enc8x_done

 .align	5

 Lctr32_enc8x_two:

@@ -1841,7 +1841,7 @@ Lctr32_enc8x_two:

 	stvx_u		$out0,$x00,$out

 	stvx_u		$out1,$x10,$out

 	addi		$out,$out,0x20

-	b		Lcbc_dec8x_done

+	b		Lctr32_enc8x_done

 .align	5

 Lctr32_enc8x_one:

diff -up openssl-1.1.1b/crypto/bio/b_addr.c.sync openssl-1.1.1b/crypto/bio/b_addr.c

--- openssl-1.1.1b/crypto/bio/b_addr.c.sync	2019-02-26 15:15:30.000000000 +0100

+++ openssl-1.1.1b/crypto/bio/b_addr.c	2019-05-03 08:55:51.555406608 +0200

@@ -683,6 +683,12 @@ int BIO_lookup_ex(const char *host, cons

         hints.ai_family = family;

         hints.ai_socktype = socktype;

         hints.ai_protocol = protocol;

+#ifdef AI_ADDRCONFIG

+#ifdef AF_UNSPEC

+        if (family == AF_UNSPEC)

+#endif

+            hints.ai_flags |= AI_ADDRCONFIG;

+#endif

         if (lookup_type == BIO_LOOKUP_SERVER)

             hints.ai_flags |= AI_PASSIVE;

diff -up openssl-1.1.1b/crypto/bio/bss_mem.c.sync openssl-1.1.1b/crypto/bio/bss_mem.c

--- openssl-1.1.1b/crypto/bio/bss_mem.c.sync	2019-02-26 15:15:30.000000000 +0100

+++ openssl-1.1.1b/crypto/bio/bss_mem.c	2019-05-03 08:55:51.556406591 +0200

@@ -57,7 +57,12 @@ static const BIO_METHOD secmem_method =

     NULL,                      /* mem_callback_ctrl */

 };

-/* BIO memory stores buffer and read pointer  */

+/*

+ * BIO memory stores buffer and read pointer

+ * however the roles are different for read only BIOs.

+ * In that case the readp just stores the original state

+ * to be used for reset.

+ */

 typedef struct bio_buf_mem_st {

     struct buf_mem_st *buf;   /* allocated buffer */

     struct buf_mem_st *readp; /* read pointer */

@@ -192,11 +197,14 @@ static int mem_read(BIO *b, char *out, i

     BIO_BUF_MEM *bbm = (BIO_BUF_MEM *)b->ptr;

     BUF_MEM *bm = bbm->readp;

+    if (b->flags & BIO_FLAGS_MEM_RDONLY)

+        bm = bbm->buf;

     BIO_clear_retry_flags(b);

     ret = (outl >= 0 && (size_t)outl > bm->length) ? (int)bm->length : outl;

     if ((out != NULL) && (ret > 0)) {

         memcpy(out, bm->data, ret);

         bm->length -= ret;

+        bm->max -= ret;

         bm->data += ret;

     } else if (bm->length == 0) {

         ret = b->num;

@@ -241,29 +249,36 @@ static long mem_ctrl(BIO *b, int cmd, lo

     BIO_BUF_MEM *bbm = (BIO_BUF_MEM *)b->ptr;

     BUF_MEM *bm;

+    if (b->flags & BIO_FLAGS_MEM_RDONLY)

+        bm = bbm->buf;

+    else

+        bm = bbm->readp;

+

     switch (cmd) {

     case BIO_CTRL_RESET:

         bm = bbm->buf;

         if (bm->data != NULL) {

-            /* For read only case reset to the start again */

-            if ((b->flags & BIO_FLAGS_MEM_RDONLY) || (b->flags & BIO_FLAGS_NONCLEAR_RST)) {

-                bm->length = bm->max;

+            if (!(b->flags & BIO_FLAGS_MEM_RDONLY)) {

+                if (b->flags & BIO_FLAGS_NONCLEAR_RST) {

+                    bm->length = bm->max;

+                } else {

+                    memset(bm->data, 0, bm->max);

+                    bm->length = 0;

+                }

+                *bbm->readp = *bbm->buf;

             } else {

-                memset(bm->data, 0, bm->max);

-                bm->length = 0;

+                /* For read only case just reset to the start again */

+                *bbm->buf = *bbm->readp;

             }

-            *bbm->readp = *bbm->buf;

         }

         break;

     case BIO_CTRL_EOF:

-        bm = bbm->readp;

         ret = (long)(bm->length == 0);

         break;

     case BIO_C_SET_BUF_MEM_EOF_RETURN:

         b->num = (int)num;

         break;

     case BIO_CTRL_INFO:

-        bm = bbm->readp;

         ret = (long)bm->length;

         if (ptr != NULL) {

             pptr = (char **)ptr;

@@ -278,8 +293,9 @@ static long mem_ctrl(BIO *b, int cmd, lo

         break;

     case BIO_C_GET_BUF_MEM_PTR:

         if (ptr != NULL) {

-            mem_buf_sync(b);

-            bm = bbm->readp;

+            if (!(b->flags & BIO_FLAGS_MEM_RDONLY))

+                mem_buf_sync(b);

+            bm = bbm->buf;

             pptr = (char **)ptr;

             *pptr = (char *)bm;

         }

@@ -294,7 +310,6 @@ static long mem_ctrl(BIO *b, int cmd, lo

         ret = 0L;

         break;

     case BIO_CTRL_PENDING:

-        bm = bbm->readp;

         ret = (long)bm->length;

         break;

     case BIO_CTRL_DUP:

@@ -318,6 +333,8 @@ static int mem_gets(BIO *bp, char *buf,

     BIO_BUF_MEM *bbm = (BIO_BUF_MEM *)bp->ptr;

     BUF_MEM *bm = bbm->readp;

+    if (bp->flags & BIO_FLAGS_MEM_RDONLY)

+        bm = bbm->buf;

     BIO_clear_retry_flags(bp);

     j = bm->length;

     if ((size - 1) < j)

diff -up openssl-1.1.1b/crypto/bn/asm/ppc.pl.sync openssl-1.1.1b/crypto/bn/asm/ppc.pl

--- openssl-1.1.1b/crypto/bn/asm/ppc.pl.sync	2019-02-26 15:15:30.000000000 +0100

+++ openssl-1.1.1b/crypto/bn/asm/ppc.pl	2019-05-03 08:55:51.530407037 +0200

@@ -258,6 +258,7 @@ $data=<

 # .text section

 	.machine	"any"

+	.text

 #

 #	NOTE:	The following label name should be changed to

diff -up openssl-1.1.1b/crypto/bn/bn_ctx.c.sync openssl-1.1.1b/crypto/bn/bn_ctx.c

--- openssl-1.1.1b/crypto/bn/bn_ctx.c.sync	2019-02-26 15:15:30.000000000 +0100

+++ openssl-1.1.1b/crypto/bn/bn_ctx.c	2019-05-03 08:55:51.524407140 +0200

@@ -194,6 +194,8 @@ void BN_CTX_start(BN_CTX *ctx)

 void BN_CTX_end(BN_CTX *ctx)

 {

+    if (ctx == NULL)

+        return;

     CTXDBG_ENTRY("BN_CTX_end", ctx);

     if (ctx->err_stack)

         ctx->err_stack--;

diff -up openssl-1.1.1b/crypto/bn/bn_lib.c.sync openssl-1.1.1b/crypto/bn/bn_lib.c

--- openssl-1.1.1b/crypto/bn/bn_lib.c.sync	2019-02-26 15:15:30.000000000 +0100

+++ openssl-1.1.1b/crypto/bn/bn_lib.c	2019-05-03 08:55:51.525407123 +0200

@@ -338,6 +338,8 @@ void BN_swap(BIGNUM *a, BIGNUM *b)

 void BN_clear(BIGNUM *a)

 {

+    if (a == NULL)

+        return;

     bn_check_top(a);

     if (a->d != NULL)

         OPENSSL_cleanse(a->d, sizeof(*a->d) * a->dmax);

diff -up openssl-1.1.1b/crypto/bn/bn_prime.c.sync openssl-1.1.1b/crypto/bn/bn_prime.c

--- openssl-1.1.1b/crypto/bn/bn_prime.c.sync	2019-02-26 15:15:30.000000000 +0100

+++ openssl-1.1.1b/crypto/bn/bn_prime.c	2019-05-03 08:55:51.525407123 +0200

@@ -135,8 +135,7 @@ int BN_generate_prime_ex(BIGNUM *ret, in

     found = 1;

  err:

     OPENSSL_free(mods);

-    if (ctx != NULL)

-        BN_CTX_end(ctx);

+    BN_CTX_end(ctx);

     BN_CTX_free(ctx);

     bn_check_top(ret);

     return found;

diff -up openssl-1.1.1b/crypto/chacha/build.info.sync openssl-1.1.1b/crypto/chacha/build.info

--- openssl-1.1.1b/crypto/chacha/build.info.sync	2019-02-26 15:15:30.000000000 +0100

+++ openssl-1.1.1b/crypto/chacha/build.info	2019-05-03 08:55:51.538406900 +0200

@@ -9,6 +9,8 @@ GENERATE[chacha-armv4.S]=asm/chacha-armv

 INCLUDE[chacha-armv4.o]=..

 GENERATE[chacha-armv8.S]=asm/chacha-armv8.pl $(PERLASM_SCHEME)

 INCLUDE[chacha-armv8.o]=..

+GENERATE[chacha-s390x.S]=asm/chacha-s390x.pl $(PERLASM_SCHEME)

+INCLUDE[chacha-s390x.o]=..

 BEGINRAW[Makefile(unix)]

 ##### CHACHA assembler implementations

diff -up openssl-1.1.1b/crypto/conf/conf_sap.c.sync openssl-1.1.1b/crypto/conf/conf_sap.c

--- openssl-1.1.1b/crypto/conf/conf_sap.c.sync	2019-02-26 15:15:30.000000000 +0100

+++ openssl-1.1.1b/crypto/conf/conf_sap.c	2019-05-03 08:55:51.550406694 +0200

@@ -35,6 +35,7 @@ void OPENSSL_config(const char *appname)

     memset(&settings, 0, sizeof(settings));

     if (appname != NULL)

         settings.appname = strdup(appname);

+    settings.flags = DEFAULT_CONF_MFLAGS;

     OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CONFIG, &settings);

 }

 #endif

diff -up openssl-1.1.1b/crypto/dh/dh_check.c.sync openssl-1.1.1b/crypto/dh/dh_check.c

--- openssl-1.1.1b/crypto/dh/dh_check.c.sync	2019-02-26 15:15:30.000000000 +0100

+++ openssl-1.1.1b/crypto/dh/dh_check.c	2019-05-03 08:55:51.525407123 +0200

@@ -58,10 +58,8 @@ int DH_check_params(const DH *dh, int *r

     ok = 1;

  err:

-    if (ctx != NULL) {

-        BN_CTX_end(ctx);

-        BN_CTX_free(ctx);

-    }

+    BN_CTX_end(ctx);

+    BN_CTX_free(ctx);

     return ok;

 }

@@ -171,10 +169,8 @@ int DH_check(const DH *dh, int *ret)

     }

     ok = 1;

  err:

-    if (ctx != NULL) {

-        BN_CTX_end(ctx);

-        BN_CTX_free(ctx);

-    }

+    BN_CTX_end(ctx);

+    BN_CTX_free(ctx);

     return ok;

 }

@@ -225,9 +221,7 @@ int DH_check_pub_key(const DH *dh, const

     ok = 1;

  err:

-    if (ctx != NULL) {

-        BN_CTX_end(ctx);

-        BN_CTX_free(ctx);

-    }

+    BN_CTX_end(ctx);

+    BN_CTX_free(ctx);

     return ok;

 }

diff -up openssl-1.1.1b/crypto/dh/dh_gen.c.sync openssl-1.1.1b/crypto/dh/dh_gen.c

--- openssl-1.1.1b/crypto/dh/dh_gen.c.sync	2019-05-03 08:55:45.170516224 +0200

+++ openssl-1.1.1b/crypto/dh/dh_gen.c	2019-05-03 08:55:51.525407123 +0200

@@ -144,9 +144,7 @@ static int dh_builtin_genparams(DH *ret,

         ok = 0;

     }

-    if (ctx != NULL) {

-        BN_CTX_end(ctx);

-        BN_CTX_free(ctx);

-    }

+    BN_CTX_end(ctx);

+    BN_CTX_free(ctx);

     return ok;

 }

diff -up openssl-1.1.1b/crypto/dh/dh_key.c.sync openssl-1.1.1b/crypto/dh/dh_key.c

--- openssl-1.1.1b/crypto/dh/dh_key.c.sync	2019-05-03 08:55:45.170516224 +0200

+++ openssl-1.1.1b/crypto/dh/dh_key.c	2019-05-03 08:55:51.526407106 +0200

@@ -237,10 +237,8 @@ static int compute_key(unsigned char *ke

     ret = BN_bn2bin(tmp, key);

  err:

-    if (ctx != NULL) {

-        BN_CTX_end(ctx);

-        BN_CTX_free(ctx);

-    }

+    BN_CTX_end(ctx);

+    BN_CTX_free(ctx);

     return ret;

 }

diff -up openssl-1.1.1b/crypto/dsa/dsa_gen.c.sync openssl-1.1.1b/crypto/dsa/dsa_gen.c

--- openssl-1.1.1b/crypto/dsa/dsa_gen.c.sync	2019-05-03 08:55:45.171516207 +0200

+++ openssl-1.1.1b/crypto/dsa/dsa_gen.c	2019-05-03 08:55:51.526407106 +0200

@@ -308,8 +308,7 @@ int dsa_builtin_paramgen(DSA *ret, size_

         if (seed_out)

             memcpy(seed_out, seed, qsize);

     }

-    if (ctx)

-        BN_CTX_end(ctx);

+    BN_CTX_end(ctx);

     BN_CTX_free(ctx);

     BN_MONT_CTX_free(mont);

     return ok;

@@ -641,8 +640,7 @@ int dsa_builtin_paramgen2(DSA *ret, size

     OPENSSL_free(seed);

     if (seed_out != seed_tmp)

         OPENSSL_free(seed_tmp);

-    if (ctx)

-        BN_CTX_end(ctx);

+    BN_CTX_end(ctx);

     BN_CTX_free(ctx);

     BN_MONT_CTX_free(mont);

     EVP_MD_CTX_free(mctx);

diff -up openssl-1.1.1b/crypto/ec/ecdh_ossl.c.sync openssl-1.1.1b/crypto/ec/ecdh_ossl.c

--- openssl-1.1.1b/crypto/ec/ecdh_ossl.c.sync	2019-05-03 08:55:45.171516207 +0200

+++ openssl-1.1.1b/crypto/ec/ecdh_ossl.c	2019-05-03 08:55:51.556406591 +0200

@@ -123,7 +123,7 @@ int ecdh_simple_compute_key(unsigned cha

     ret = 1;

  err:

-    EC_POINT_free(tmp);

+    EC_POINT_clear_free(tmp);

     if (ctx)

         BN_CTX_end(ctx);

     BN_CTX_free(ctx);

diff -up openssl-1.1.1b/crypto/ec/ec_lib.c.sync openssl-1.1.1b/crypto/ec/ec_lib.c

--- openssl-1.1.1b/crypto/ec/ec_lib.c.sync	2019-02-26 15:15:30.000000000 +0100

+++ openssl-1.1.1b/crypto/ec/ec_lib.c	2019-05-03 08:55:51.527407088 +0200

@@ -1074,8 +1074,7 @@ static int ec_field_inverse_mod_ord(cons

     ret = 1;

  err:

-    if (ctx != NULL)

-        BN_CTX_end(ctx);

+    BN_CTX_end(ctx);

     BN_CTX_free(new_ctx);

     return ret;

 }

diff -up openssl-1.1.1b/crypto/ec/ec_mult.c.sync openssl-1.1.1b/crypto/ec/ec_mult.c

--- openssl-1.1.1b/crypto/ec/ec_mult.c.sync	2019-02-26 15:15:30.000000000 +0100

+++ openssl-1.1.1b/crypto/ec/ec_mult.c	2019-05-03 08:55:51.540406865 +0200

@@ -378,7 +378,7 @@ int ec_scalar_mul_ladder(const EC_GROUP

  err:

     EC_POINT_free(p);

-    EC_POINT_free(s);

+    EC_POINT_clear_free(s);

     BN_CTX_end(ctx);

     return ret;

@@ -441,7 +441,7 @@ int ec_wNAF_mul(const EC_GROUP *group, E

          * scalar multiplication implementation based on a Montgomery ladder,

          * with various timing attack defenses.

          */

-        if ((scalar != NULL) && (num == 0)) {

+        if ((scalar != group->order) && (scalar != NULL) && (num == 0)) {

             /*-

              * In this case we want to compute scalar * GeneratorPoint: this

              * codepath is reached most prominently by (ephemeral) key

@@ -452,7 +452,7 @@ int ec_wNAF_mul(const EC_GROUP *group, E

              */

             return ec_scalar_mul_ladder(group, r, scalar, NULL, ctx);

         }

-        if ((scalar == NULL) && (num == 1)) {

+        if ((scalar == NULL) && (num == 1) && (scalars[0] != group->order)) {

             /*-

              * In this case we want to compute scalar * VariablePoint: this

              * codepath is reached most prominently by the second half of ECDH,

@@ -948,8 +948,7 @@ int ec_wNAF_precompute_mult(EC_GROUP *gr

     ret = 1;

  err:

-    if (ctx != NULL)

-        BN_CTX_end(ctx);

+    BN_CTX_end(ctx);

     BN_CTX_free(new_ctx);

     EC_ec_pre_comp_free(pre_comp);

     if (points) {

diff -up openssl-1.1.1b/crypto/ec/ecp_nistp521.c.sync openssl-1.1.1b/crypto/ec/ecp_nistp521.c

--- openssl-1.1.1b/crypto/ec/ecp_nistp521.c.sync	2019-02-26 15:15:30.000000000 +0100

+++ openssl-1.1.1b/crypto/ec/ecp_nistp521.c	2019-05-03 08:55:51.532407003 +0200

@@ -357,10 +357,15 @@ static void felem_diff64(felem out, cons

 static void felem_diff_128_64(largefelem out, const felem in)

 {

     /*

-     * In order to prevent underflow, we add 0 mod p before subtracting.

+     * In order to prevent underflow, we add 64p mod p (which is equivalent

+     * to 0 mod p) before subtracting. p is 2^521 - 1, i.e. in binary a 521

+     * digit number with all bits set to 1. See "The representation of field

+     * elements" comment above for a description of how limbs are used to

+     * represent a number. 64p is represented with 8 limbs containing a number

+     * with 58 bits set and one limb with a number with 57 bits set.

      */

-    static const limb two63m6 = (((limb) 1) << 62) - (((limb) 1) << 5);

-    static const limb two63m5 = (((limb) 1) << 62) - (((limb) 1) << 4);

+    static const limb two63m6 = (((limb) 1) << 63) - (((limb) 1) << 6);

+    static const limb two63m5 = (((limb) 1) << 63) - (((limb) 1) << 5);

     out[0] += two63m6 - in[0];

     out[1] += two63m5 - in[1];

diff -up openssl-1.1.1b/crypto/ec/ecp_nistz256.c.sync openssl-1.1.1b/crypto/ec/ecp_nistz256.c

--- openssl-1.1.1b/crypto/ec/ecp_nistz256.c.sync	2019-02-26 15:15:30.000000000 +0100

+++ openssl-1.1.1b/crypto/ec/ecp_nistz256.c	2019-05-03 08:55:51.528407071 +0200

@@ -888,8 +888,7 @@ __owur static int ecp_nistz256_mult_prec

     ret = 1;

  err:

-    if (ctx != NULL)

-        BN_CTX_end(ctx);

+    BN_CTX_end(ctx);

     BN_CTX_free(new_ctx);

     EC_nistz256_pre_comp_free(pre_comp);

diff -up openssl-1.1.1b/crypto/ec/ecp_smpl.c.sync openssl-1.1.1b/crypto/ec/ecp_smpl.c

--- openssl-1.1.1b/crypto/ec/ecp_smpl.c.sync	2019-05-03 08:55:45.152516533 +0200

+++ openssl-1.1.1b/crypto/ec/ecp_smpl.c	2019-05-03 08:55:51.528407071 +0200

@@ -312,8 +312,7 @@ int ec_GFp_simple_group_check_discrimina

     ret = 1;

  err:

-    if (ctx != NULL)

-        BN_CTX_end(ctx);

+    BN_CTX_end(ctx);

     BN_CTX_free(new_ctx);

     return ret;

 }

@@ -792,8 +791,7 @@ int ec_GFp_simple_add(const EC_GROUP *gr

     ret = 1;

  end:

-    if (ctx)                    /* otherwise we already called BN_CTX_end */

-        BN_CTX_end(ctx);

+    BN_CTX_end(ctx);

     BN_CTX_free(new_ctx);

     return ret;

 }

diff -up openssl-1.1.1b/crypto/err/err.c.sync openssl-1.1.1b/crypto/err/err.c

--- openssl-1.1.1b/crypto/err/err.c.sync	2019-02-26 15:15:30.000000000 +0100

+++ openssl-1.1.1b/crypto/err/err.c	2019-05-03 08:55:51.548406728 +0200

@@ -523,8 +523,24 @@ static unsigned long get_error_values(in

         return ERR_R_INTERNAL_ERROR;

     }

+    while (es->bottom != es->top) {

+        if (es->err_flags[es->top] & ERR_FLAG_CLEAR) {

+            err_clear(es, es->top);

+            es->top = es->top > 0 ? es->top - 1 : ERR_NUM_ERRORS - 1;

+            continue;

+        }

+        i = (es->bottom + 1) % ERR_NUM_ERRORS;

+        if (es->err_flags[i] & ERR_FLAG_CLEAR) {

+            es->bottom = i;

+            err_clear(es, es->bottom);

+            continue;

+        }

+        break;

+    }

+

     if (es->bottom == es->top)

         return 0;

+

     if (top)

         i = es->top;            /* last error */

     else

@@ -913,25 +929,6 @@ int ERR_clear_last_mark(void)

     return 1;

 }

-#ifdef UINTPTR_T

-# undef UINTPTR_T

-#endif

-/*

- * uintptr_t is the answer, but unfortunately C89, current "least common

- * denominator" doesn't define it. Most legacy platforms typedef it anyway,

- * so that attempt to fill the gaps means that one would have to identify

- * that track these gaps, which would be undesirable. Macro it is...

- */

-#if defined(__VMS) && __INITIAL_POINTER_SIZE==64

-/*

- * But we can't use size_t on VMS, because it adheres to sizeof(size_t)==4

- * even in 64-bit builds, which means that it won't work as mask.

- */

-# define UINTPTR_T unsigned long long

-#else

-# define UINTPTR_T size_t

-#endif

-

 void err_clear_last_constant_time(int clear)

 {

     ERR_STATE *es;

@@ -943,11 +940,11 @@ void err_clear_last_constant_time(int cl

     top = es->top;

-    es->err_flags[top] &= ~(0 - clear);

-    es->err_buffer[top] &= ~(0UL - clear);

-    es->err_file[top] = (const char *)((UINTPTR_T)es->err_file[top] &

-                                       ~((UINTPTR_T)0 - clear));

-    es->err_line[top] |= 0 - clear;

-

-    es->top = (top + ERR_NUM_ERRORS - clear) % ERR_NUM_ERRORS;

+    /*

+     * Flag error as cleared but remove it elsewhere to avoid two errors

+     * accessing the same error stack location, revealing timing information.

+     */

+    clear = constant_time_select_int(constant_time_eq_int(clear, 0),

+                                     0, ERR_FLAG_CLEAR);

+    es->err_flags[top] |= clear;

 }

diff -up openssl-1.1.1b/crypto/evp/digest.c.sync openssl-1.1.1b/crypto/evp/digest.c

--- openssl-1.1.1b/crypto/evp/digest.c.sync	2019-05-03 08:55:51.553406642 +0200

+++ openssl-1.1.1b/crypto/evp/digest.c	2019-05-03 08:56:40.800561168 +0200

@@ -171,6 +171,9 @@ int EVP_DigestUpdate(EVP_MD_CTX *ctx, co

 #ifdef OPENSSL_FIPS

     FIPS_selftest_check();

 #endif

+    if (count == 0)

+        return 1;

+

     return ctx->update(ctx, data, count);

 }

diff -up openssl-1.1.1b/crypto/evp/e_aria.c.sync openssl-1.1.1b/crypto/evp/e_aria.c

--- openssl-1.1.1b/crypto/evp/e_aria.c.sync	2019-02-26 15:15:30.000000000 +0100

+++ openssl-1.1.1b/crypto/evp/e_aria.c	2019-05-03 08:55:51.545406779 +0200

@@ -486,6 +486,16 @@ static int aria_gcm_cipher(EVP_CIPHER_CT

     return 0;

 }

+static int aria_gcm_cleanup(EVP_CIPHER_CTX *ctx)

+{

+    EVP_ARIA_GCM_CTX *gctx = EVP_C_DATA(EVP_ARIA_GCM_CTX, ctx);

+

+    if (gctx->iv != EVP_CIPHER_CTX_iv_noconst(ctx))

+        OPENSSL_free(gctx->iv);

+

+    return 1;

+}

+

 static int aria_ccm_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,

                             const unsigned char *iv, int enc)

 {

@@ -727,6 +737,8 @@ static int aria_ccm_cipher(EVP_CIPHER_CT

     }

 }

+#define aria_ccm_cleanup    NULL

+

 #define ARIA_AUTH_FLAGS  (EVP_CIPH_FLAG_DEFAULT_ASN1 \

                           | EVP_CIPH_CUSTOM_IV | EVP_CIPH_FLAG_CUSTOM_CIPHER \

                           | EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CTRL_INIT \

@@ -739,7 +751,7 @@ static const EVP_CIPHER aria_##keylen##_

         ARIA_AUTH_FLAGS|EVP_CIPH_##MODE##_MODE,    \

         aria_##mode##_init_key,                    \

         aria_##mode##_cipher,                      \

-        NULL,                                      \

+        aria_##mode##_cleanup,                     \

         sizeof(EVP_ARIA_##MODE##_CTX),             \

         NULL,NULL,aria_##mode##_ctrl,NULL };       \

 const EVP_CIPHER *EVP_aria_##keylen##_##mode(void) \

diff -up openssl-1.1.1b/crypto/evp/e_chacha20_poly1305.c.sync openssl-1.1.1b/crypto/evp/e_chacha20_poly1305.c

--- openssl-1.1.1b/crypto/evp/e_chacha20_poly1305.c.sync	2019-05-03 08:55:45.216515434 +0200

+++ openssl-1.1.1b/crypto/evp/e_chacha20_poly1305.c	2019-05-03 08:55:51.551406676 +0200

@@ -30,6 +30,8 @@ typedef struct {

 #define data(ctx)   ((EVP_CHACHA_KEY *)(ctx)->cipher_data)

+#define CHACHA20_POLY1305_MAX_IVLEN     12

+

 static int chacha_init_key(EVP_CIPHER_CTX *ctx,

                            const unsigned char user_key[CHACHA_KEY_SIZE],

                            const unsigned char iv[CHACHA_CTR_SIZE], int enc)

@@ -533,7 +535,7 @@ static int chacha20_poly1305_ctrl(EVP_CI

         return 1;

     case EVP_CTRL_AEAD_SET_IVLEN:

-        if (arg <= 0 || arg > CHACHA_CTR_SIZE)

+        if (arg <= 0 || arg > CHACHA20_POLY1305_MAX_IVLEN)

             return 0;

         actx->nonce_len = arg;

         return 1;

diff -up openssl-1.1.1b/crypto/evp/evp_enc.c.sync openssl-1.1.1b/crypto/evp/evp_enc.c

--- openssl-1.1.1b/crypto/evp/evp_enc.c.sync	2019-05-03 08:55:45.174516155 +0200

+++ openssl-1.1.1b/crypto/evp/evp_enc.c	2019-05-03 08:55:51.544406797 +0200

@@ -338,6 +338,11 @@ static int evp_EncryptDecryptUpdate(EVP_

     bl = ctx->cipher->block_size;

+    if (inl <= 0) {

+        *outl = 0;

+        return inl == 0;

+    }

+

     if (ctx->cipher->flags & EVP_CIPH_FLAG_CUSTOM_CIPHER) {

         /* If block size > 1 then the cipher will have to do this check */

         if (bl == 1 && is_partially_overlapping(out, in, cmpl)) {

@@ -353,10 +358,6 @@ static int evp_EncryptDecryptUpdate(EVP_

         return 1;

     }

-    if (inl <= 0) {

-        *outl = 0;

-        return inl == 0;

-    }

     if (is_partially_overlapping(out + ctx->buf_len, in, cmpl)) {

         EVPerr(EVP_F_EVP_ENCRYPTDECRYPTUPDATE, EVP_R_PARTIALLY_OVERLAPPING);

         return 0;

@@ -490,6 +491,11 @@ int EVP_DecryptUpdate(EVP_CIPHER_CTX *ct

     if (EVP_CIPHER_CTX_test_flags(ctx, EVP_CIPH_FLAG_LENGTH_BITS))

         cmpl = (cmpl + 7) / 8;

+    if (inl <= 0) {

+        *outl = 0;

+        return inl == 0;

+    }

+

     if (ctx->cipher->flags & EVP_CIPH_FLAG_CUSTOM_CIPHER) {

         if (b == 1 && is_partially_overlapping(out, in, cmpl)) {

             EVPerr(EVP_F_EVP_DECRYPTUPDATE, EVP_R_PARTIALLY_OVERLAPPING);

@@ -505,11 +511,6 @@ int EVP_DecryptUpdate(EVP_CIPHER_CTX *ct

         return 1;

     }

-    if (inl <= 0) {

-        *outl = 0;

-        return inl == 0;

-    }

-

     if (ctx->flags & EVP_CIPH_NO_PADDING)

         return evp_EncryptDecryptUpdate(ctx, out, outl, in, inl);

diff -up openssl-1.1.1b/crypto/hmac/hmac.c.sync openssl-1.1.1b/crypto/hmac/hmac.c

--- openssl-1.1.1b/crypto/hmac/hmac.c.sync	2019-05-03 08:55:45.189515898 +0200

+++ openssl-1.1.1b/crypto/hmac/hmac.c	2019-05-03 08:55:51.538406900 +0200

@@ -35,6 +35,13 @@ int HMAC_Init_ex(HMAC_CTX *ctx, const vo

         return 0;

     }

+    /*

+     * The HMAC construction is not allowed  to be used with the

+     * extendable-output functions (XOF) shake128 and shake256.

+     */

+    if ((EVP_MD_meth_get_flags(md) & EVP_MD_FLAG_XOF) != 0)

+        return 0;

+

     if (key != NULL) {

 #ifdef OPENSSL_FIPS

         if (FIPS_mode() && !(EVP_MD_flags(md) & EVP_MD_FLAG_FIPS)

diff -up openssl-1.1.1b/crypto/init.c.sync openssl-1.1.1b/crypto/init.c

--- openssl-1.1.1b/crypto/init.c.sync	2019-02-26 15:15:30.000000000 +0100

+++ openssl-1.1.1b/crypto/init.c	2019-05-03 08:55:51.550406694 +0200

@@ -702,7 +702,7 @@ int OPENSSL_init_crypto(uint64_t opts, c

         ret = RUN_ONCE(&config, ossl_init_config);

         conf_settings = NULL;

         CRYPTO_THREAD_unlock(init_lock);

-        if (!ret)

+        if (ret <= 0)

             return 0;

     }

diff -up openssl-1.1.1b/crypto/modes/asm/ghash-x86_64.pl.sync openssl-1.1.1b/crypto/modes/asm/ghash-x86_64.pl

--- openssl-1.1.1b/crypto/modes/asm/ghash-x86_64.pl.sync	2019-02-26 15:15:30.000000000 +0100

+++ openssl-1.1.1b/crypto/modes/asm/ghash-x86_64.pl	2019-05-03 08:55:51.534406969 +0200

@@ -1155,6 +1155,7 @@ ___

 } else {

 $code.=<<___;

 	jmp	.L_init_clmul

+.cfi_endproc

 .size	gcm_init_avx,.-gcm_init_avx

 ___

 }

@@ -1594,6 +1595,7 @@ ___

 } else {

 $code.=<<___;

 	jmp	.L_ghash_clmul

+.cfi_endproc

 .size	gcm_ghash_avx,.-gcm_ghash_avx

 ___

 }

diff -up openssl-1.1.1b/crypto/modes/ccm128.c.sync openssl-1.1.1b/crypto/modes/ccm128.c

--- openssl-1.1.1b/crypto/modes/ccm128.c.sync	2019-02-26 15:15:30.000000000 +0100

+++ openssl-1.1.1b/crypto/modes/ccm128.c	2019-05-03 08:55:51.543406814 +0200

@@ -425,7 +425,7 @@ size_t CRYPTO_ccm128_tag(CCM128_CONTEXT

     M *= 2;

     M += 2;