deps: update ngtcp2 to 1.25.0

PR-URL: #64944
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>

Author: nodejs-github-bot

deps/ngtcp2/ngtcp2/crypto/boringssl/boringssl.c

@@ -278,33 +278,44 @@ int ngtcp2_crypto_cipher_ctx_encrypt_init(ngtcp2_crypto_cipher_ctx *cipher_ctx,
 constuint8_t*key) {
 ngtcp2_crypto_boringssl_cipher*hp_cipher=cipher->native_handle;
 ngtcp2_crypto_boringssl_cipher_ctx*ctx;
-intrv;
- (void)rv;
+intrv=0;
 
 ctx=malloc(sizeof(*ctx));
 if (ctx==NULL) {
 return-1;
  }
 
-ctx->type=hp_cipher->type;
-cipher_ctx->native_handle=ctx;
-
 switch (hp_cipher->type) {
 caseNGTCP2_CRYPTO_BORINGSSL_CIPHER_TYPE_AES_128:
-rv=AES_set_encrypt_key(key, 128, &ctx->aes_key);
-assert(0==rv);
-return0;
+if (AES_set_encrypt_key(key, 128, &ctx->aes_key) !=0) {
+rv=-1;
+ }
+
+break;
 caseNGTCP2_CRYPTO_BORINGSSL_CIPHER_TYPE_AES_256:
-rv=AES_set_encrypt_key(key, 256, &ctx->aes_key);
-assert(0==rv);
-return0;
+if (AES_set_encrypt_key(key, 256, &ctx->aes_key) !=0) {
+rv=-1;
+ }
+
+break;
 caseNGTCP2_CRYPTO_BORINGSSL_CIPHER_TYPE_CHACHA20:
 memcpy(ctx->key, key, sizeof(ctx->key));
-return0;
+break;
 default:
 assert(0);
 abort();
  };
+
+if (rv!=0) {
+free(ctx);
+
+returnrv;
+ }
+
+ctx->type=hp_cipher->type;
+cipher_ctx->native_handle=ctx;
+
+return0;
 }
 
 voidngtcp2_crypto_cipher_ctx_free(ngtcp2_crypto_cipher_ctx*cipher_ctx) {

deps/ngtcp2/ngtcp2/crypto/ossl/ossl.c

@@ -730,8 +730,8 @@ int ngtcp2_crypto_hkdf_extract(uint8_t *dest, const ngtcp2_crypto_md *md,
 constuint8_t*secret, size_tsecretlen,
 constuint8_t*salt, size_tsaltlen) {
 constEVP_MD*prf=md->native_handle;
-EVP_KDF*kdf=crypto_kdf_hkdf();
-EVP_KDF_CTX*kctx=EVP_KDF_CTX_new(kdf);
+EVP_KDF*kdf;
+EVP_KDF_CTX*kctx;
 intmode=EVP_KDF_HKDF_MODE_EXTRACT_ONLY;
 OSSL_PARAMparams[] = {
 OSSL_PARAM_construct_int(OSSL_KDF_PARAM_MODE, &mode),
@@ -745,13 +745,24 @@ int ngtcp2_crypto_hkdf_extract(uint8_t *dest, const ngtcp2_crypto_md *md,
  };
 intrv=0;
 
-crypto_kdf_hkdf_free(kdf);
+kdf=crypto_kdf_hkdf();
+if (!kdf) {
+return-1;
+ }
+
+kctx=EVP_KDF_CTX_new(kdf);
+if (!kctx) {
+rv=-1;
+ goto fail_kdf_ctx_new;
+ }
 
 if (EVP_KDF_derive(kctx, dest, (size_t)EVP_MD_size(prf), params) <= 0) {
 rv=-1;
  }
 
 EVP_KDF_CTX_free(kctx);
+fail_kdf_ctx_new:
+crypto_kdf_hkdf_free(kdf);
 
 returnrv;
 }
@@ -761,8 +772,8 @@ int ngtcp2_crypto_hkdf_expand(uint8_t *dest, size_t destlen,
 size_tsecretlen, constuint8_t*info,
 size_tinfolen) {
 constEVP_MD*prf=md->native_handle;
-EVP_KDF*kdf=crypto_kdf_hkdf();
-EVP_KDF_CTX*kctx=EVP_KDF_CTX_new(kdf);
+EVP_KDF*kdf;
+EVP_KDF_CTX*kctx;
 intmode=EVP_KDF_HKDF_MODE_EXPAND_ONLY;
 OSSL_PARAMparams[] = {
 OSSL_PARAM_construct_int(OSSL_KDF_PARAM_MODE, &mode),
@@ -776,13 +787,24 @@ int ngtcp2_crypto_hkdf_expand(uint8_t *dest, size_t destlen,
  };
 intrv=0;
 
-crypto_kdf_hkdf_free(kdf);
+kdf=crypto_kdf_hkdf();
+if (!kdf) {
+return-1;
+ }
+
+kctx=EVP_KDF_CTX_new(kdf);
+if (!kctx) {
+rv=-1;
+ goto fail_kdf_ctx_new;
+ }
 
 if (EVP_KDF_derive(kctx, dest, destlen, params) <= 0) {
 rv=-1;
  }
 
 EVP_KDF_CTX_free(kctx);
+fail_kdf_ctx_new:
+crypto_kdf_hkdf_free(kdf);
 
 returnrv;
 }
@@ -792,8 +814,8 @@ int ngtcp2_crypto_hkdf(uint8_t *dest, size_t destlen,
 size_tsecretlen, constuint8_t*salt, size_tsaltlen,
 constuint8_t*info, size_tinfolen) {
 constEVP_MD*prf=md->native_handle;
-EVP_KDF*kdf=crypto_kdf_hkdf();
-EVP_KDF_CTX*kctx=EVP_KDF_CTX_new(kdf);
+EVP_KDF*kdf;
+EVP_KDF_CTX*kctx;
 OSSL_PARAMparams[] = {
 OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
  (char*)EVP_MD_get0_name(prf), 0),
@@ -807,13 +829,24 @@ int ngtcp2_crypto_hkdf(uint8_t *dest, size_t destlen,
  };
 intrv=0;
 
-crypto_kdf_hkdf_free(kdf);
+kdf=crypto_kdf_hkdf();
+if (!kdf) {
+return-1;
+ }
+
+kctx=EVP_KDF_CTX_new(kdf);
+if (!kctx) {
+rv=-1;
+ goto fail_kdf_ctx_new;
+ }
 
 if (EVP_KDF_derive(kctx, dest, destlen, params) <= 0) {
 rv=-1;
  }
 
 EVP_KDF_CTX_free(kctx);
+fail_kdf_ctx_new:
+crypto_kdf_hkdf_free(kdf);
 
 returnrv;
 }

deps/ngtcp2/ngtcp2/crypto/quictls/quictls.c

@@ -44,7 +44,6 @@
 #include"shared.h"
 
 #ifOPENSSL_VERSION_NUMBER >= 0x30000000L
-staticintcrypto_initialized;
 staticEVP_CIPHER*crypto_aes_128_gcm;
 staticEVP_CIPHER*crypto_aes_256_gcm;
 staticEVP_CIPHER*crypto_chacha20_poly1305;
@@ -57,57 +56,19 @@ static EVP_MD *crypto_sha384;
 staticEVP_KDF*crypto_hkdf;
 
 intngtcp2_crypto_quictls_init(void) {
+/* We do not care whether the pre-fetch succeeds or not. If it
+ fails, it returns NULL, which is still the default value, and our
+ code should still work with it. */
 crypto_aes_128_gcm=EVP_CIPHER_fetch(NULL, "AES-128-GCM", NULL);
-if (crypto_aes_128_gcm==NULL) {
-return-1;
- }
-
 crypto_aes_256_gcm=EVP_CIPHER_fetch(NULL, "AES-256-GCM", NULL);
-if (crypto_aes_256_gcm==NULL) {
-return-1;
- }
-
 crypto_chacha20_poly1305=EVP_CIPHER_fetch(NULL, "ChaCha20-Poly1305", NULL);
-if (crypto_chacha20_poly1305==NULL) {
-return-1;
- }
-
 crypto_aes_128_ccm=EVP_CIPHER_fetch(NULL, "AES-128-CCM", NULL);
-if (crypto_aes_128_ccm==NULL) {
-return-1;
- }
-
 crypto_aes_128_ecb=EVP_CIPHER_fetch(NULL, "AES-128-ECB", NULL);
-if (crypto_aes_128_ecb==NULL) {
-return-1;
- }
-
 crypto_aes_256_ecb=EVP_CIPHER_fetch(NULL, "AES-256-ECB", NULL);
-if (crypto_aes_256_ecb==NULL) {
-return-1;
- }
-
 crypto_chacha20=EVP_CIPHER_fetch(NULL, "ChaCha20", NULL);
-if (crypto_chacha20==NULL) {
-return-1;
- }
-
 crypto_sha256=EVP_MD_fetch(NULL, "sha256", NULL);
-if (crypto_sha256==NULL) {
-return-1;
- }
-
 crypto_sha384=EVP_MD_fetch(NULL, "sha384", NULL);
-if (crypto_sha384==NULL) {
-return-1;
- }
-
 crypto_hkdf=EVP_KDF_fetch(NULL, "hkdf", NULL);
-if (crypto_hkdf==NULL) {
-return-1;
- }
-
-crypto_initialized=1;
 
 return0;
 }
@@ -191,6 +152,12 @@ static EVP_KDF *crypto_kdf_hkdf(void) {
 
 returnEVP_KDF_fetch(NULL, "hkdf", NULL);
 }
+
+staticvoidcrypto_kdf_hkdf_free(EVP_KDF*kdf) {
+if (kdf&&crypto_hkdf!=kdf) {
+EVP_KDF_free(kdf);
+ }
+}
 #else/* !(OPENSSL_VERSION_NUMBER >= 0x30000000L) */
 # definecrypto_aead_aes_128_gcm EVP_aes_128_gcm
 # definecrypto_aead_aes_256_gcm EVP_aes_256_gcm
@@ -524,8 +491,8 @@ int ngtcp2_crypto_hkdf_extract(uint8_t *dest, const ngtcp2_crypto_md *md,
 constuint8_t*salt, size_tsaltlen) {
 #ifOPENSSL_VERSION_NUMBER >= 0x30000000L
 constEVP_MD*prf=md->native_handle;
-EVP_KDF*kdf=crypto_kdf_hkdf();
-EVP_KDF_CTX*kctx=EVP_KDF_CTX_new(kdf);
+EVP_KDF*kdf;
+EVP_KDF_CTX*kctx;
 intmode=EVP_KDF_HKDF_MODE_EXTRACT_ONLY;
 OSSL_PARAMparams[] = {
 OSSL_PARAM_construct_int(OSSL_KDF_PARAM_MODE, &mode),
@@ -539,15 +506,24 @@ int ngtcp2_crypto_hkdf_extract(uint8_t *dest, const ngtcp2_crypto_md *md,
  };
 intrv=0;
 
-if (!crypto_initialized) {
-EVP_KDF_free(kdf);
+kdf=crypto_kdf_hkdf();
+if (!kdf) {
+return-1;
+ }
+
+kctx=EVP_KDF_CTX_new(kdf);
+if (!kctx) {
+rv=-1;
+ goto fail_kdf_ctx_new;
  }
 
 if (EVP_KDF_derive(kctx, dest, (size_t)EVP_MD_size(prf), params) <= 0) {
 rv=-1;
  }
 
 EVP_KDF_CTX_free(kctx);
+fail_kdf_ctx_new:
+crypto_kdf_hkdf_free(kdf);
 
 returnrv;
 #else/* !(OPENSSL_VERSION_NUMBER >= 0x30000000L) */
@@ -581,8 +557,8 @@ int ngtcp2_crypto_hkdf_expand(uint8_t *dest, size_t destlen,
 size_tinfolen) {
 #ifOPENSSL_VERSION_NUMBER >= 0x30000000L
 constEVP_MD*prf=md->native_handle;
-EVP_KDF*kdf=crypto_kdf_hkdf();
-EVP_KDF_CTX*kctx=EVP_KDF_CTX_new(kdf);
+EVP_KDF*kdf;
+EVP_KDF_CTX*kctx;
 intmode=EVP_KDF_HKDF_MODE_EXPAND_ONLY;
 OSSL_PARAMparams[] = {
 OSSL_PARAM_construct_int(OSSL_KDF_PARAM_MODE, &mode),
@@ -596,15 +572,24 @@ int ngtcp2_crypto_hkdf_expand(uint8_t *dest, size_t destlen,
  };
 intrv=0;
 
-if (!crypto_initialized) {
-EVP_KDF_free(kdf);
+kdf=crypto_kdf_hkdf();
+if (!kdf) {
+return-1;
+ }
+
+kctx=EVP_KDF_CTX_new(kdf);
+if (!kctx) {
+rv=-1;
+ goto fail_kdf_ctx_new;
  }
 
 if (EVP_KDF_derive(kctx, dest, destlen, params) <= 0) {
 rv=-1;
  }
 
 EVP_KDF_CTX_free(kctx);
+fail_kdf_ctx_new:
+crypto_kdf_hkdf_free(kdf);
 
 returnrv;
 #else/* !(OPENSSL_VERSION_NUMBER >= 0x30000000L) */
@@ -637,8 +622,8 @@ int ngtcp2_crypto_hkdf(uint8_t *dest, size_t destlen,
 constuint8_t*info, size_tinfolen) {
 #ifOPENSSL_VERSION_NUMBER >= 0x30000000L
 constEVP_MD*prf=md->native_handle;
-EVP_KDF*kdf=crypto_kdf_hkdf();
-EVP_KDF_CTX*kctx=EVP_KDF_CTX_new(kdf);
+EVP_KDF*kdf;
+EVP_KDF_CTX*kctx;
 OSSL_PARAMparams[] = {
 OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
  (char*)EVP_MD_get0_name(prf), 0),
@@ -652,15 +637,24 @@ int ngtcp2_crypto_hkdf(uint8_t *dest, size_t destlen,
  };
 intrv=0;
 
-if (!crypto_initialized) {
-EVP_KDF_free(kdf);
+kdf=crypto_kdf_hkdf();
+if (!kdf) {
+return-1;
+ }
+
+kctx=EVP_KDF_CTX_new(kdf);
+if (!kctx) {
+rv=-1;
+ goto fail_kdf_ctx_new;
  }
 
 if (EVP_KDF_derive(kctx, dest, destlen, params) <= 0) {
 rv=-1;
  }
 
 EVP_KDF_CTX_free(kctx);
+fail_kdf_ctx_new:
+crypto_kdf_hkdf_free(kdf);
 
 returnrv;
 #else/* !(OPENSSL_VERSION_NUMBER >= 0x30000000L) */

deps/ngtcp2/ngtcp2/crypto/boringssl/boringssl.c

@@ -278,33 +278,44 @@ int ngtcp2_crypto_cipher_ctx_encrypt_init(ngtcp2_crypto_cipher_ctx *cipher_ctx,
 constuint8_t*key) {
 ngtcp2_crypto_boringssl_cipher*hp_cipher=cipher->native_handle;
 ngtcp2_crypto_boringssl_cipher_ctx*ctx;
-intrv;
- (void)rv;
+intrv=0;
 
 ctx=malloc(sizeof(*ctx));
 if (ctx==NULL) {
 return-1;
  }
 
-ctx->type=hp_cipher->type;
-cipher_ctx->native_handle=ctx;
-
 switch (hp_cipher->type) {
 caseNGTCP2_CRYPTO_BORINGSSL_CIPHER_TYPE_AES_128:
-rv=AES_set_encrypt_key(key, 128, &ctx->aes_key);
-assert(0==rv);
-return0;
+if (AES_set_encrypt_key(key, 128, &ctx->aes_key) !=0) {
+rv=-1;
+ }
+
+break;
 caseNGTCP2_CRYPTO_BORINGSSL_CIPHER_TYPE_AES_256:
-rv=AES_set_encrypt_key(key, 256, &ctx->aes_key);
-assert(0==rv);
-return0;
+if (AES_set_encrypt_key(key, 256, &ctx->aes_key) !=0) {
+rv=-1;
+ }
+
+break;
 caseNGTCP2_CRYPTO_BORINGSSL_CIPHER_TYPE_CHACHA20:
 memcpy(ctx->key, key, sizeof(ctx->key));
-return0;
+break;
 default:
 assert(0);
 abort();
  };
+
+if (rv!=0) {
+free(ctx);
+
+returnrv;
+ }
+
+ctx->type=hp_cipher->type;
+cipher_ctx->native_handle=ctx;
+
+return0;
 }
 
 voidngtcp2_crypto_cipher_ctx_free(ngtcp2_crypto_cipher_ctx*cipher_ctx) {

deps/ngtcp2/ngtcp2/crypto/ossl/ossl.c

@@ -730,8 +730,8 @@ int ngtcp2_crypto_hkdf_extract(uint8_t *dest, const ngtcp2_crypto_md *md,
 constuint8_t*secret, size_tsecretlen,
 constuint8_t*salt, size_tsaltlen) {
 constEVP_MD*prf=md->native_handle;
-EVP_KDF*kdf=crypto_kdf_hkdf();
-EVP_KDF_CTX*kctx=EVP_KDF_CTX_new(kdf);
+EVP_KDF*kdf;
+EVP_KDF_CTX*kctx;
 intmode=EVP_KDF_HKDF_MODE_EXTRACT_ONLY;
 OSSL_PARAMparams[] = {
 OSSL_PARAM_construct_int(OSSL_KDF_PARAM_MODE, &mode),
@@ -745,13 +745,24 @@ int ngtcp2_crypto_hkdf_extract(uint8_t *dest, const ngtcp2_crypto_md *md,
  };
 intrv=0;
 
-crypto_kdf_hkdf_free(kdf);
+kdf=crypto_kdf_hkdf();
+if (!kdf) {
+return-1;
+ }
+
+kctx=EVP_KDF_CTX_new(kdf);
+if (!kctx) {
+rv=-1;
+ goto fail_kdf_ctx_new;
+ }
 
 if (EVP_KDF_derive(kctx, dest, (size_t)EVP_MD_size(prf), params) <= 0) {
 rv=-1;
  }
 
 EVP_KDF_CTX_free(kctx);
+fail_kdf_ctx_new:
+crypto_kdf_hkdf_free(kdf);
 
 returnrv;
 }
@@ -761,8 +772,8 @@ int ngtcp2_crypto_hkdf_expand(uint8_t *dest, size_t destlen,
 size_tsecretlen, constuint8_t*info,
 size_tinfolen) {
 constEVP_MD*prf=md->native_handle;
-EVP_KDF*kdf=crypto_kdf_hkdf();
-EVP_KDF_CTX*kctx=EVP_KDF_CTX_new(kdf);
+EVP_KDF*kdf;
+EVP_KDF_CTX*kctx;
 intmode=EVP_KDF_HKDF_MODE_EXPAND_ONLY;
 OSSL_PARAMparams[] = {
 OSSL_PARAM_construct_int(OSSL_KDF_PARAM_MODE, &mode),
@@ -776,13 +787,24 @@ int ngtcp2_crypto_hkdf_expand(uint8_t *dest, size_t destlen,
  };
 intrv=0;
 
-crypto_kdf_hkdf_free(kdf);
+kdf=crypto_kdf_hkdf();
+if (!kdf) {
+return-1;
+ }
+
+kctx=EVP_KDF_CTX_new(kdf);
+if (!kctx) {
+rv=-1;
+ goto fail_kdf_ctx_new;
+ }
 
 if (EVP_KDF_derive(kctx, dest, destlen, params) <= 0) {
 rv=-1;
  }
 
 EVP_KDF_CTX_free(kctx);
+fail_kdf_ctx_new:
+crypto_kdf_hkdf_free(kdf);
 
 returnrv;
 }
@@ -792,8 +814,8 @@ int ngtcp2_crypto_hkdf(uint8_t *dest, size_t destlen,
 size_tsecretlen, constuint8_t*salt, size_tsaltlen,
 constuint8_t*info, size_tinfolen) {
 constEVP_MD*prf=md->native_handle;
-EVP_KDF*kdf=crypto_kdf_hkdf();
-EVP_KDF_CTX*kctx=EVP_KDF_CTX_new(kdf);
+EVP_KDF*kdf;
+EVP_KDF_CTX*kctx;
 OSSL_PARAMparams[] = {
 OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
  (char*)EVP_MD_get0_name(prf), 0),
@@ -807,13 +829,24 @@ int ngtcp2_crypto_hkdf(uint8_t *dest, size_t destlen,
  };
 intrv=0;
 
-crypto_kdf_hkdf_free(kdf);
+kdf=crypto_kdf_hkdf();
+if (!kdf) {
+return-1;
+ }
+
+kctx=EVP_KDF_CTX_new(kdf);
+if (!kctx) {
+rv=-1;
+ goto fail_kdf_ctx_new;
+ }
 
 if (EVP_KDF_derive(kctx, dest, destlen, params) <= 0) {
 rv=-1;
  }
 
 EVP_KDF_CTX_free(kctx);
+fail_kdf_ctx_new:
+crypto_kdf_hkdf_free(kdf);
 
 returnrv;
 }

deps/ngtcp2/ngtcp2/crypto/quictls/quictls.c

@@ -44,7 +44,6 @@
 #include"shared.h"
 
 #ifOPENSSL_VERSION_NUMBER >= 0x30000000L
-staticintcrypto_initialized;
 staticEVP_CIPHER*crypto_aes_128_gcm;
 staticEVP_CIPHER*crypto_aes_256_gcm;
 staticEVP_CIPHER*crypto_chacha20_poly1305;
@@ -57,57 +56,19 @@ static EVP_MD *crypto_sha384;
 staticEVP_KDF*crypto_hkdf;
 
 intngtcp2_crypto_quictls_init(void) {
+/* We do not care whether the pre-fetch succeeds or not. If it
+ fails, it returns NULL, which is still the default value, and our
+ code should still work with it. */
 crypto_aes_128_gcm=EVP_CIPHER_fetch(NULL, "AES-128-GCM", NULL);
-if (crypto_aes_128_gcm==NULL) {
-return-1;
- }
-
 crypto_aes_256_gcm=EVP_CIPHER_fetch(NULL, "AES-256-GCM", NULL);
-if (crypto_aes_256_gcm==NULL) {
-return-1;
- }
-
 crypto_chacha20_poly1305=EVP_CIPHER_fetch(NULL, "ChaCha20-Poly1305", NULL);
-if (crypto_chacha20_poly1305==NULL) {
-return-1;
- }
-
 crypto_aes_128_ccm=EVP_CIPHER_fetch(NULL, "AES-128-CCM", NULL);
-if (crypto_aes_128_ccm==NULL) {
-return-1;
- }
-
 crypto_aes_128_ecb=EVP_CIPHER_fetch(NULL, "AES-128-ECB", NULL);
-if (crypto_aes_128_ecb==NULL) {
-return-1;
- }
-
 crypto_aes_256_ecb=EVP_CIPHER_fetch(NULL, "AES-256-ECB", NULL);
-if (crypto_aes_256_ecb==NULL) {
-return-1;
- }
-
 crypto_chacha20=EVP_CIPHER_fetch(NULL, "ChaCha20", NULL);
-if (crypto_chacha20==NULL) {
-return-1;
- }
-
 crypto_sha256=EVP_MD_fetch(NULL, "sha256", NULL);
-if (crypto_sha256==NULL) {
-return-1;
- }
-
 crypto_sha384=EVP_MD_fetch(NULL, "sha384", NULL);
-if (crypto_sha384==NULL) {
-return-1;
- }
-
 crypto_hkdf=EVP_KDF_fetch(NULL, "hkdf", NULL);
-if (crypto_hkdf==NULL) {
-return-1;
- }
-
-crypto_initialized=1;
 
 return0;
 }
@@ -191,6 +152,12 @@ static EVP_KDF *crypto_kdf_hkdf(void) {
 
 returnEVP_KDF_fetch(NULL, "hkdf", NULL);
 }
+
+staticvoidcrypto_kdf_hkdf_free(EVP_KDF*kdf) {
+if (kdf&&crypto_hkdf!=kdf) {
+EVP_KDF_free(kdf);
+ }
+}
 #else/* !(OPENSSL_VERSION_NUMBER >= 0x30000000L) */
 # definecrypto_aead_aes_128_gcm EVP_aes_128_gcm
 # definecrypto_aead_aes_256_gcm EVP_aes_256_gcm
@@ -524,8 +491,8 @@ int ngtcp2_crypto_hkdf_extract(uint8_t *dest, const ngtcp2_crypto_md *md,
 constuint8_t*salt, size_tsaltlen) {
 #ifOPENSSL_VERSION_NUMBER >= 0x30000000L
 constEVP_MD*prf=md->native_handle;
-EVP_KDF*kdf=crypto_kdf_hkdf();
-EVP_KDF_CTX*kctx=EVP_KDF_CTX_new(kdf);
+EVP_KDF*kdf;
+EVP_KDF_CTX*kctx;
 intmode=EVP_KDF_HKDF_MODE_EXTRACT_ONLY;
 OSSL_PARAMparams[] = {
 OSSL_PARAM_construct_int(OSSL_KDF_PARAM_MODE, &mode),
@@ -539,15 +506,24 @@ int ngtcp2_crypto_hkdf_extract(uint8_t *dest, const ngtcp2_crypto_md *md,
  };
 intrv=0;
 
-if (!crypto_initialized) {
-EVP_KDF_free(kdf);
+kdf=crypto_kdf_hkdf();
+if (!kdf) {
+return-1;
+ }
+
+kctx=EVP_KDF_CTX_new(kdf);
+if (!kctx) {
+rv=-1;
+ goto fail_kdf_ctx_new;
  }
 
 if (EVP_KDF_derive(kctx, dest, (size_t)EVP_MD_size(prf), params) <= 0) {
 rv=-1;
  }
 
 EVP_KDF_CTX_free(kctx);
+fail_kdf_ctx_new:
+crypto_kdf_hkdf_free(kdf);
 
 returnrv;
 #else/* !(OPENSSL_VERSION_NUMBER >= 0x30000000L) */
@@ -581,8 +557,8 @@ int ngtcp2_crypto_hkdf_expand(uint8_t *dest, size_t destlen,
 size_tinfolen) {
 #ifOPENSSL_VERSION_NUMBER >= 0x30000000L
 constEVP_MD*prf=md->native_handle;
-EVP_KDF*kdf=crypto_kdf_hkdf();
-EVP_KDF_CTX*kctx=EVP_KDF_CTX_new(kdf);
+EVP_KDF*kdf;
+EVP_KDF_CTX*kctx;
 intmode=EVP_KDF_HKDF_MODE_EXPAND_ONLY;
 OSSL_PARAMparams[] = {
 OSSL_PARAM_construct_int(OSSL_KDF_PARAM_MODE, &mode),
@@ -596,15 +572,24 @@ int ngtcp2_crypto_hkdf_expand(uint8_t *dest, size_t destlen,
  };
 intrv=0;
 
-if (!crypto_initialized) {
-EVP_KDF_free(kdf);
+kdf=crypto_kdf_hkdf();
+if (!kdf) {
+return-1;
+ }
+
+kctx=EVP_KDF_CTX_new(kdf);
+if (!kctx) {
+rv=-1;
+ goto fail_kdf_ctx_new;
  }
 
 if (EVP_KDF_derive(kctx, dest, destlen, params) <= 0) {
 rv=-1;
  }
 
 EVP_KDF_CTX_free(kctx);
+fail_kdf_ctx_new:
+crypto_kdf_hkdf_free(kdf);
 
 returnrv;
 #else/* !(OPENSSL_VERSION_NUMBER >= 0x30000000L) */
@@ -637,8 +622,8 @@ int ngtcp2_crypto_hkdf(uint8_t *dest, size_t destlen,
 constuint8_t*info, size_tinfolen) {
 #ifOPENSSL_VERSION_NUMBER >= 0x30000000L
 constEVP_MD*prf=md->native_handle;
-EVP_KDF*kdf=crypto_kdf_hkdf();
-EVP_KDF_CTX*kctx=EVP_KDF_CTX_new(kdf);
+EVP_KDF*kdf;
+EVP_KDF_CTX*kctx;
 OSSL_PARAMparams[] = {
 OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
  (char*)EVP_MD_get0_name(prf), 0),
@@ -652,15 +637,24 @@ int ngtcp2_crypto_hkdf(uint8_t *dest, size_t destlen,
  };
 intrv=0;
 
-if (!crypto_initialized) {
-EVP_KDF_free(kdf);
+kdf=crypto_kdf_hkdf();
+if (!kdf) {
+return-1;
+ }
+
+kctx=EVP_KDF_CTX_new(kdf);
+if (!kctx) {
+rv=-1;
+ goto fail_kdf_ctx_new;
  }
 
 if (EVP_KDF_derive(kctx, dest, destlen, params) <= 0) {
 rv=-1;
  }
 
 EVP_KDF_CTX_free(kctx);
+fail_kdf_ctx_new:
+crypto_kdf_hkdf_free(kdf);
 
 returnrv;
 #else/* !(OPENSSL_VERSION_NUMBER >= 0x30000000L) */

deps/ngtcp2/ngtcp2/crypto/boringssl/boringssl.c

@@ -278,33 +278,44 @@ int ngtcp2_crypto_cipher_ctx_encrypt_init(ngtcp2_crypto_cipher_ctx *cipher_ctx,
 constuint8_t*key) {
 ngtcp2_crypto_boringssl_cipher*hp_cipher=cipher->native_handle;
 ngtcp2_crypto_boringssl_cipher_ctx*ctx;
-intrv;
- (void)rv;
+intrv=0;
 
 ctx=malloc(sizeof(*ctx));
 if (ctx==NULL) {
 return-1;
  }
 
-ctx->type=hp_cipher->type;
-cipher_ctx->native_handle=ctx;
-
 switch (hp_cipher->type) {
 caseNGTCP2_CRYPTO_BORINGSSL_CIPHER_TYPE_AES_128:
-rv=AES_set_encrypt_key(key, 128, &ctx->aes_key);
-assert(0==rv);
-return0;
+if (AES_set_encrypt_key(key, 128, &ctx->aes_key) !=0) {
+rv=-1;
+ }
+
+break;
 caseNGTCP2_CRYPTO_BORINGSSL_CIPHER_TYPE_AES_256:
-rv=AES_set_encrypt_key(key, 256, &ctx->aes_key);
-assert(0==rv);
-return0;
+if (AES_set_encrypt_key(key, 256, &ctx->aes_key) !=0) {
+rv=-1;
+ }
+
+break;
 caseNGTCP2_CRYPTO_BORINGSSL_CIPHER_TYPE_CHACHA20:
 memcpy(ctx->key, key, sizeof(ctx->key));
-return0;
+break;
 default:
 assert(0);
 abort();
  };
+
+if (rv!=0) {
+free(ctx);
+
+returnrv;
+ }
+
+ctx->type=hp_cipher->type;
+cipher_ctx->native_handle=ctx;
+
+return0;
 }
 
 voidngtcp2_crypto_cipher_ctx_free(ngtcp2_crypto_cipher_ctx*cipher_ctx) {

deps/ngtcp2/ngtcp2/crypto/ossl/ossl.c

@@ -730,8 +730,8 @@ int ngtcp2_crypto_hkdf_extract(uint8_t *dest, const ngtcp2_crypto_md *md,
 constuint8_t*secret, size_tsecretlen,
 constuint8_t*salt, size_tsaltlen) {
 constEVP_MD*prf=md->native_handle;
-EVP_KDF*kdf=crypto_kdf_hkdf();
-EVP_KDF_CTX*kctx=EVP_KDF_CTX_new(kdf);
+EVP_KDF*kdf;
+EVP_KDF_CTX*kctx;
 intmode=EVP_KDF_HKDF_MODE_EXTRACT_ONLY;
 OSSL_PARAMparams[] = {
 OSSL_PARAM_construct_int(OSSL_KDF_PARAM_MODE, &mode),
@@ -745,13 +745,24 @@ int ngtcp2_crypto_hkdf_extract(uint8_t *dest, const ngtcp2_crypto_md *md,
  };
 intrv=0;
 
-crypto_kdf_hkdf_free(kdf);
+kdf=crypto_kdf_hkdf();
+if (!kdf) {
+return-1;
+ }
+
+kctx=EVP_KDF_CTX_new(kdf);
+if (!kctx) {
+rv=-1;
+ goto fail_kdf_ctx_new;
+ }
 
 if (EVP_KDF_derive(kctx, dest, (size_t)EVP_MD_size(prf), params) <= 0) {
 rv=-1;
  }
 
 EVP_KDF_CTX_free(kctx);
+fail_kdf_ctx_new:
+crypto_kdf_hkdf_free(kdf);
 
 returnrv;
 }
@@ -761,8 +772,8 @@ int ngtcp2_crypto_hkdf_expand(uint8_t *dest, size_t destlen,
 size_tsecretlen, constuint8_t*info,
 size_tinfolen) {
 constEVP_MD*prf=md->native_handle;
-EVP_KDF*kdf=crypto_kdf_hkdf();
-EVP_KDF_CTX*kctx=EVP_KDF_CTX_new(kdf);
+EVP_KDF*kdf;
+EVP_KDF_CTX*kctx;
 intmode=EVP_KDF_HKDF_MODE_EXPAND_ONLY;
 OSSL_PARAMparams[] = {
 OSSL_PARAM_construct_int(OSSL_KDF_PARAM_MODE, &mode),
@@ -776,13 +787,24 @@ int ngtcp2_crypto_hkdf_expand(uint8_t *dest, size_t destlen,
  };
 intrv=0;
 
-crypto_kdf_hkdf_free(kdf);
+kdf=crypto_kdf_hkdf();
+if (!kdf) {
+return-1;
+ }
+
+kctx=EVP_KDF_CTX_new(kdf);
+if (!kctx) {
+rv=-1;
+ goto fail_kdf_ctx_new;
+ }
 
 if (EVP_KDF_derive(kctx, dest, destlen, params) <= 0) {
 rv=-1;
  }
 
 EVP_KDF_CTX_free(kctx);
+fail_kdf_ctx_new:
+crypto_kdf_hkdf_free(kdf);
 
 returnrv;
 }
@@ -792,8 +814,8 @@ int ngtcp2_crypto_hkdf(uint8_t *dest, size_t destlen,
 size_tsecretlen, constuint8_t*salt, size_tsaltlen,
 constuint8_t*info, size_tinfolen) {
 constEVP_MD*prf=md->native_handle;
-EVP_KDF*kdf=crypto_kdf_hkdf();
-EVP_KDF_CTX*kctx=EVP_KDF_CTX_new(kdf);
+EVP_KDF*kdf;
+EVP_KDF_CTX*kctx;
 OSSL_PARAMparams[] = {
 OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
  (char*)EVP_MD_get0_name(prf), 0),
@@ -807,13 +829,24 @@ int ngtcp2_crypto_hkdf(uint8_t *dest, size_t destlen,
  };
 intrv=0;
 
-crypto_kdf_hkdf_free(kdf);
+kdf=crypto_kdf_hkdf();
+if (!kdf) {
+return-1;
+ }
+
+kctx=EVP_KDF_CTX_new(kdf);
+if (!kctx) {
+rv=-1;
+ goto fail_kdf_ctx_new;
+ }
 
 if (EVP_KDF_derive(kctx, dest, destlen, params) <= 0) {
 rv=-1;
  }
 
 EVP_KDF_CTX_free(kctx);
+fail_kdf_ctx_new:
+crypto_kdf_hkdf_free(kdf);
 
 returnrv;
 }

deps/ngtcp2/ngtcp2/crypto/quictls/quictls.c

@@ -44,7 +44,6 @@
 #include"shared.h"
 
 #ifOPENSSL_VERSION_NUMBER >= 0x30000000L
-staticintcrypto_initialized;
 staticEVP_CIPHER*crypto_aes_128_gcm;
 staticEVP_CIPHER*crypto_aes_256_gcm;
 staticEVP_CIPHER*crypto_chacha20_poly1305;
@@ -57,57 +56,19 @@ static EVP_MD *crypto_sha384;
 staticEVP_KDF*crypto_hkdf;
 
 intngtcp2_crypto_quictls_init(void) {
+/* We do not care whether the pre-fetch succeeds or not. If it
+ fails, it returns NULL, which is still the default value, and our
+ code should still work with it. */
 crypto_aes_128_gcm=EVP_CIPHER_fetch(NULL, "AES-128-GCM", NULL);
-if (crypto_aes_128_gcm==NULL) {
-return-1;
- }
-
 crypto_aes_256_gcm=EVP_CIPHER_fetch(NULL, "AES-256-GCM", NULL);
-if (crypto_aes_256_gcm==NULL) {
-return-1;
- }
-
 crypto_chacha20_poly1305=EVP_CIPHER_fetch(NULL, "ChaCha20-Poly1305", NULL);
-if (crypto_chacha20_poly1305==NULL) {
-return-1;
- }
-
 crypto_aes_128_ccm=EVP_CIPHER_fetch(NULL, "AES-128-CCM", NULL);
-if (crypto_aes_128_ccm==NULL) {
-return-1;
- }
-
 crypto_aes_128_ecb=EVP_CIPHER_fetch(NULL, "AES-128-ECB", NULL);
-if (crypto_aes_128_ecb==NULL) {
-return-1;
- }
-
 crypto_aes_256_ecb=EVP_CIPHER_fetch(NULL, "AES-256-ECB", NULL);
-if (crypto_aes_256_ecb==NULL) {
-return-1;
- }
-
 crypto_chacha20=EVP_CIPHER_fetch(NULL, "ChaCha20", NULL);
-if (crypto_chacha20==NULL) {
-return-1;
- }
-
 crypto_sha256=EVP_MD_fetch(NULL, "sha256", NULL);
-if (crypto_sha256==NULL) {
-return-1;
- }
-
 crypto_sha384=EVP_MD_fetch(NULL, "sha384", NULL);
-if (crypto_sha384==NULL) {
-return-1;
- }
-
 crypto_hkdf=EVP_KDF_fetch(NULL, "hkdf", NULL);
-if (crypto_hkdf==NULL) {
-return-1;
- }
-
-crypto_initialized=1;
 
 return0;
 }
@@ -191,6 +152,12 @@ static EVP_KDF *crypto_kdf_hkdf(void) {
 
 returnEVP_KDF_fetch(NULL, "hkdf", NULL);
 }
+
+staticvoidcrypto_kdf_hkdf_free(EVP_KDF*kdf) {
+if (kdf&&crypto_hkdf!=kdf) {
+EVP_KDF_free(kdf);
+ }
+}
 #else/* !(OPENSSL_VERSION_NUMBER >= 0x30000000L) */
 # definecrypto_aead_aes_128_gcm EVP_aes_128_gcm
 # definecrypto_aead_aes_256_gcm EVP_aes_256_gcm
@@ -524,8 +491,8 @@ int ngtcp2_crypto_hkdf_extract(uint8_t *dest, const ngtcp2_crypto_md *md,
 constuint8_t*salt, size_tsaltlen) {
 #ifOPENSSL_VERSION_NUMBER >= 0x30000000L
 constEVP_MD*prf=md->native_handle;
-EVP_KDF*kdf=crypto_kdf_hkdf();
-EVP_KDF_CTX*kctx=EVP_KDF_CTX_new(kdf);
+EVP_KDF*kdf;
+EVP_KDF_CTX*kctx;
 intmode=EVP_KDF_HKDF_MODE_EXTRACT_ONLY;
 OSSL_PARAMparams[] = {
 OSSL_PARAM_construct_int(OSSL_KDF_PARAM_MODE, &mode),
@@ -539,15 +506,24 @@ int ngtcp2_crypto_hkdf_extract(uint8_t *dest, const ngtcp2_crypto_md *md,
  };
 intrv=0;
 
-if (!crypto_initialized) {
-EVP_KDF_free(kdf);
+kdf=crypto_kdf_hkdf();
+if (!kdf) {
+return-1;
+ }
+
+kctx=EVP_KDF_CTX_new(kdf);
+if (!kctx) {
+rv=-1;
+ goto fail_kdf_ctx_new;
  }
 
 if (EVP_KDF_derive(kctx, dest, (size_t)EVP_MD_size(prf), params) <= 0) {
 rv=-1;
  }
 
 EVP_KDF_CTX_free(kctx);
+fail_kdf_ctx_new:
+crypto_kdf_hkdf_free(kdf);
 
 returnrv;
 #else/* !(OPENSSL_VERSION_NUMBER >= 0x30000000L) */
@@ -581,8 +557,8 @@ int ngtcp2_crypto_hkdf_expand(uint8_t *dest, size_t destlen,
 size_tinfolen) {
 #ifOPENSSL_VERSION_NUMBER >= 0x30000000L
 constEVP_MD*prf=md->native_handle;
-EVP_KDF*kdf=crypto_kdf_hkdf();
-EVP_KDF_CTX*kctx=EVP_KDF_CTX_new(kdf);
+EVP_KDF*kdf;
+EVP_KDF_CTX*kctx;
 intmode=EVP_KDF_HKDF_MODE_EXPAND_ONLY;
 OSSL_PARAMparams[] = {
 OSSL_PARAM_construct_int(OSSL_KDF_PARAM_MODE, &mode),
@@ -596,15 +572,24 @@ int ngtcp2_crypto_hkdf_expand(uint8_t *dest, size_t destlen,
  };
 intrv=0;
 
-if (!crypto_initialized) {
-EVP_KDF_free(kdf);
+kdf=crypto_kdf_hkdf();
+if (!kdf) {
+return-1;
+ }
+
+kctx=EVP_KDF_CTX_new(kdf);
+if (!kctx) {
+rv=-1;
+ goto fail_kdf_ctx_new;
  }
 
 if (EVP_KDF_derive(kctx, dest, destlen, params) <= 0) {
 rv=-1;
  }
 
 EVP_KDF_CTX_free(kctx);
+fail_kdf_ctx_new:
+crypto_kdf_hkdf_free(kdf);
 
 returnrv;
 #else/* !(OPENSSL_VERSION_NUMBER >= 0x30000000L) */
@@ -637,8 +622,8 @@ int ngtcp2_crypto_hkdf(uint8_t *dest, size_t destlen,
 constuint8_t*info, size_tinfolen) {
 #ifOPENSSL_VERSION_NUMBER >= 0x30000000L
 constEVP_MD*prf=md->native_handle;
-EVP_KDF*kdf=crypto_kdf_hkdf();
-EVP_KDF_CTX*kctx=EVP_KDF_CTX_new(kdf);
+EVP_KDF*kdf;
+EVP_KDF_CTX*kctx;
 OSSL_PARAMparams[] = {
 OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
  (char*)EVP_MD_get0_name(prf), 0),
@@ -652,15 +637,24 @@ int ngtcp2_crypto_hkdf(uint8_t *dest, size_t destlen,
  };
 intrv=0;
 
-if (!crypto_initialized) {
-EVP_KDF_free(kdf);
+kdf=crypto_kdf_hkdf();
+if (!kdf) {
+return-1;
+ }
+
+kctx=EVP_KDF_CTX_new(kdf);
+if (!kctx) {
+rv=-1;
+ goto fail_kdf_ctx_new;
  }
 
 if (EVP_KDF_derive(kctx, dest, destlen, params) <= 0) {
 rv=-1;
  }
 
 EVP_KDF_CTX_free(kctx);
+fail_kdf_ctx_new:
+crypto_kdf_hkdf_free(kdf);
 
 returnrv;
 #else/* !(OPENSSL_VERSION_NUMBER >= 0x30000000L) */

deps/ngtcp2/ngtcp2/crypto/boringssl/boringssl.c

@@ -278,33 +278,44 @@ int ngtcp2_crypto_cipher_ctx_encrypt_init(ngtcp2_crypto_cipher_ctx *cipher_ctx,
 constuint8_t*key) {
 ngtcp2_crypto_boringssl_cipher*hp_cipher=cipher->native_handle;
 ngtcp2_crypto_boringssl_cipher_ctx*ctx;
-intrv;
- (void)rv;
+intrv=0;
 
 ctx=malloc(sizeof(*ctx));
 if (ctx==NULL) {
 return-1;
  }
 
-ctx->type=hp_cipher->type;
-cipher_ctx->native_handle=ctx;
-
 switch (hp_cipher->type) {
 caseNGTCP2_CRYPTO_BORINGSSL_CIPHER_TYPE_AES_128:
-rv=AES_set_encrypt_key(key, 128, &ctx->aes_key);
-assert(0==rv);
-return0;
+if (AES_set_encrypt_key(key, 128, &ctx->aes_key) !=0) {
+rv=-1;
+ }
+
+break;
 caseNGTCP2_CRYPTO_BORINGSSL_CIPHER_TYPE_AES_256:
-rv=AES_set_encrypt_key(key, 256, &ctx->aes_key);
-assert(0==rv);
-return0;
+if (AES_set_encrypt_key(key, 256, &ctx->aes_key) !=0) {
+rv=-1;
+ }
+
+break;
 caseNGTCP2_CRYPTO_BORINGSSL_CIPHER_TYPE_CHACHA20:
 memcpy(ctx->key, key, sizeof(ctx->key));
-return0;
+break;
 default:
 assert(0);
 abort();
  };
+
+if (rv!=0) {
+free(ctx);
+
+returnrv;
+ }
+
+ctx->type=hp_cipher->type;
+cipher_ctx->native_handle=ctx;
+
+return0;
 }
 
 voidngtcp2_crypto_cipher_ctx_free(ngtcp2_crypto_cipher_ctx*cipher_ctx) {

deps/ngtcp2/ngtcp2/crypto/ossl/ossl.c

@@ -730,8 +730,8 @@ int ngtcp2_crypto_hkdf_extract(uint8_t *dest, const ngtcp2_crypto_md *md,
 constuint8_t*secret, size_tsecretlen,
 constuint8_t*salt, size_tsaltlen) {
 constEVP_MD*prf=md->native_handle;
-EVP_KDF*kdf=crypto_kdf_hkdf();
-EVP_KDF_CTX*kctx=EVP_KDF_CTX_new(kdf);
+EVP_KDF*kdf;
+EVP_KDF_CTX*kctx;
 intmode=EVP_KDF_HKDF_MODE_EXTRACT_ONLY;
 OSSL_PARAMparams[] = {
 OSSL_PARAM_construct_int(OSSL_KDF_PARAM_MODE, &mode),
@@ -745,13 +745,24 @@ int ngtcp2_crypto_hkdf_extract(uint8_t *dest, const ngtcp2_crypto_md *md,
  };
 intrv=0;
 
-crypto_kdf_hkdf_free(kdf);
+kdf=crypto_kdf_hkdf();
+if (!kdf) {
+return-1;
+ }
+
+kctx=EVP_KDF_CTX_new(kdf);
+if (!kctx) {
+rv=-1;
+ goto fail_kdf_ctx_new;
+ }
 
 if (EVP_KDF_derive(kctx, dest, (size_t)EVP_MD_size(prf), params) <= 0) {
 rv=-1;
  }
 
 EVP_KDF_CTX_free(kctx);
+fail_kdf_ctx_new:
+crypto_kdf_hkdf_free(kdf);
 
 returnrv;
 }
@@ -761,8 +772,8 @@ int ngtcp2_crypto_hkdf_expand(uint8_t *dest, size_t destlen,
 size_tsecretlen, constuint8_t*info,
 size_tinfolen) {
 constEVP_MD*prf=md->native_handle;
-EVP_KDF*kdf=crypto_kdf_hkdf();
-EVP_KDF_CTX*kctx=EVP_KDF_CTX_new(kdf);
+EVP_KDF*kdf;
+EVP_KDF_CTX*kctx;
 intmode=EVP_KDF_HKDF_MODE_EXPAND_ONLY;
 OSSL_PARAMparams[] = {
 OSSL_PARAM_construct_int(OSSL_KDF_PARAM_MODE, &mode),
@@ -776,13 +787,24 @@ int ngtcp2_crypto_hkdf_expand(uint8_t *dest, size_t destlen,
  };
 intrv=0;
 
-crypto_kdf_hkdf_free(kdf);
+kdf=crypto_kdf_hkdf();
+if (!kdf) {
+return-1;
+ }
+
+kctx=EVP_KDF_CTX_new(kdf);
+if (!kctx) {
+rv=-1;
+ goto fail_kdf_ctx_new;
+ }
 
 if (EVP_KDF_derive(kctx, dest, destlen, params) <= 0) {
 rv=-1;
  }
 
 EVP_KDF_CTX_free(kctx);
+fail_kdf_ctx_new:
+crypto_kdf_hkdf_free(kdf);
 
 returnrv;
 }
@@ -792,8 +814,8 @@ int ngtcp2_crypto_hkdf(uint8_t *dest, size_t destlen,
 size_tsecretlen, constuint8_t*salt, size_tsaltlen,
 constuint8_t*info, size_tinfolen) {
 constEVP_MD*prf=md->native_handle;
-EVP_KDF*kdf=crypto_kdf_hkdf();
-EVP_KDF_CTX*kctx=EVP_KDF_CTX_new(kdf);
+EVP_KDF*kdf;
+EVP_KDF_CTX*kctx;
 OSSL_PARAMparams[] = {
 OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
  (char*)EVP_MD_get0_name(prf), 0),
@@ -807,13 +829,24 @@ int ngtcp2_crypto_hkdf(uint8_t *dest, size_t destlen,
  };
 intrv=0;
 
-crypto_kdf_hkdf_free(kdf);
+kdf=crypto_kdf_hkdf();
+if (!kdf) {
+return-1;
+ }
+
+kctx=EVP_KDF_CTX_new(kdf);
+if (!kctx) {
+rv=-1;
+ goto fail_kdf_ctx_new;
+ }
 
 if (EVP_KDF_derive(kctx, dest, destlen, params) <= 0) {
 rv=-1;
  }
 
 EVP_KDF_CTX_free(kctx);
+fail_kdf_ctx_new:
+crypto_kdf_hkdf_free(kdf);
 
 returnrv;
 }

deps/ngtcp2/ngtcp2/crypto/quictls/quictls.c

@@ -44,7 +44,6 @@
 #include"shared.h"
 
 #ifOPENSSL_VERSION_NUMBER >= 0x30000000L
-staticintcrypto_initialized;
 staticEVP_CIPHER*crypto_aes_128_gcm;
 staticEVP_CIPHER*crypto_aes_256_gcm;
 staticEVP_CIPHER*crypto_chacha20_poly1305;
@@ -57,57 +56,19 @@ static EVP_MD *crypto_sha384;
 staticEVP_KDF*crypto_hkdf;
 
 intngtcp2_crypto_quictls_init(void) {
+/* We do not care whether the pre-fetch succeeds or not. If it
+ fails, it returns NULL, which is still the default value, and our
+ code should still work with it. */
 crypto_aes_128_gcm=EVP_CIPHER_fetch(NULL, "AES-128-GCM", NULL);
-if (crypto_aes_128_gcm==NULL) {
-return-1;
- }
-
 crypto_aes_256_gcm=EVP_CIPHER_fetch(NULL, "AES-256-GCM", NULL);
-if (crypto_aes_256_gcm==NULL) {
-return-1;
- }
-
 crypto_chacha20_poly1305=EVP_CIPHER_fetch(NULL, "ChaCha20-Poly1305", NULL);
-if (crypto_chacha20_poly1305==NULL) {
-return-1;
- }
-
 crypto_aes_128_ccm=EVP_CIPHER_fetch(NULL, "AES-128-CCM", NULL);
-if (crypto_aes_128_ccm==NULL) {
-return-1;
- }
-
 crypto_aes_128_ecb=EVP_CIPHER_fetch(NULL, "AES-128-ECB", NULL);
-if (crypto_aes_128_ecb==NULL) {
-return-1;
- }
-
 crypto_aes_256_ecb=EVP_CIPHER_fetch(NULL, "AES-256-ECB", NULL);
-if (crypto_aes_256_ecb==NULL) {
-return-1;
- }
-
 crypto_chacha20=EVP_CIPHER_fetch(NULL, "ChaCha20", NULL);
-if (crypto_chacha20==NULL) {
-return-1;
- }
-
 crypto_sha256=EVP_MD_fetch(NULL, "sha256", NULL);
-if (crypto_sha256==NULL) {
-return-1;
- }
-
 crypto_sha384=EVP_MD_fetch(NULL, "sha384", NULL);
-if (crypto_sha384==NULL) {
-return-1;
- }
-
 crypto_hkdf=EVP_KDF_fetch(NULL, "hkdf", NULL);
-if (crypto_hkdf==NULL) {
-return-1;
- }
-
-crypto_initialized=1;
 
 return0;
 }
@@ -191,6 +152,12 @@ static EVP_KDF *crypto_kdf_hkdf(void) {
 
 returnEVP_KDF_fetch(NULL, "hkdf", NULL);
 }
+
+staticvoidcrypto_kdf_hkdf_free(EVP_KDF*kdf) {
+if (kdf&&crypto_hkdf!=kdf) {
+EVP_KDF_free(kdf);
+ }
+}
 #else/* !(OPENSSL_VERSION_NUMBER >= 0x30000000L) */
 # definecrypto_aead_aes_128_gcm EVP_aes_128_gcm
 # definecrypto_aead_aes_256_gcm EVP_aes_256_gcm
@@ -524,8 +491,8 @@ int ngtcp2_crypto_hkdf_extract(uint8_t *dest, const ngtcp2_crypto_md *md,
 constuint8_t*salt, size_tsaltlen) {
 #ifOPENSSL_VERSION_NUMBER >= 0x30000000L
 constEVP_MD*prf=md->native_handle;
-EVP_KDF*kdf=crypto_kdf_hkdf();
-EVP_KDF_CTX*kctx=EVP_KDF_CTX_new(kdf);
+EVP_KDF*kdf;
+EVP_KDF_CTX*kctx;
 intmode=EVP_KDF_HKDF_MODE_EXTRACT_ONLY;
 OSSL_PARAMparams[] = {
 OSSL_PARAM_construct_int(OSSL_KDF_PARAM_MODE, &mode),
@@ -539,15 +506,24 @@ int ngtcp2_crypto_hkdf_extract(uint8_t *dest, const ngtcp2_crypto_md *md,
  };
 intrv=0;
 
-if (!crypto_initialized) {
-EVP_KDF_free(kdf);
+kdf=crypto_kdf_hkdf();
+if (!kdf) {
+return-1;
+ }
+
+kctx=EVP_KDF_CTX_new(kdf);
+if (!kctx) {
+rv=-1;
+ goto fail_kdf_ctx_new;
  }
 
 if (EVP_KDF_derive(kctx, dest, (size_t)EVP_MD_size(prf), params) <= 0) {
 rv=-1;
  }
 
 EVP_KDF_CTX_free(kctx);
+fail_kdf_ctx_new:
+crypto_kdf_hkdf_free(kdf);
 
 returnrv;
 #else/* !(OPENSSL_VERSION_NUMBER >= 0x30000000L) */
@@ -581,8 +557,8 @@ int ngtcp2_crypto_hkdf_expand(uint8_t *dest, size_t destlen,
 size_tinfolen) {
 #ifOPENSSL_VERSION_NUMBER >= 0x30000000L
 constEVP_MD*prf=md->native_handle;
-EVP_KDF*kdf=crypto_kdf_hkdf();
-EVP_KDF_CTX*kctx=EVP_KDF_CTX_new(kdf);
+EVP_KDF*kdf;
+EVP_KDF_CTX*kctx;
 intmode=EVP_KDF_HKDF_MODE_EXPAND_ONLY;
 OSSL_PARAMparams[] = {
 OSSL_PARAM_construct_int(OSSL_KDF_PARAM_MODE, &mode),
@@ -596,15 +572,24 @@ int ngtcp2_crypto_hkdf_expand(uint8_t *dest, size_t destlen,
  };
 intrv=0;
 
-if (!crypto_initialized) {
-EVP_KDF_free(kdf);
+kdf=crypto_kdf_hkdf();
+if (!kdf) {
+return-1;
+ }
+
+kctx=EVP_KDF_CTX_new(kdf);
+if (!kctx) {
+rv=-1;
+ goto fail_kdf_ctx_new;
  }
 
 if (EVP_KDF_derive(kctx, dest, destlen, params) <= 0) {
 rv=-1;
  }
 
 EVP_KDF_CTX_free(kctx);
+fail_kdf_ctx_new:
+crypto_kdf_hkdf_free(kdf);
 
 returnrv;
 #else/* !(OPENSSL_VERSION_NUMBER >= 0x30000000L) */
@@ -637,8 +622,8 @@ int ngtcp2_crypto_hkdf(uint8_t *dest, size_t destlen,
 constuint8_t*info, size_tinfolen) {
 #ifOPENSSL_VERSION_NUMBER >= 0x30000000L
 constEVP_MD*prf=md->native_handle;
-EVP_KDF*kdf=crypto_kdf_hkdf();
-EVP_KDF_CTX*kctx=EVP_KDF_CTX_new(kdf);
+EVP_KDF*kdf;
+EVP_KDF_CTX*kctx;
 OSSL_PARAMparams[] = {
 OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
  (char*)EVP_MD_get0_name(prf), 0),
@@ -652,15 +637,24 @@ int ngtcp2_crypto_hkdf(uint8_t *dest, size_t destlen,
  };
 intrv=0;
 
-if (!crypto_initialized) {
-EVP_KDF_free(kdf);
+kdf=crypto_kdf_hkdf();
+if (!kdf) {
+return-1;
+ }
+
+kctx=EVP_KDF_CTX_new(kdf);
+if (!kctx) {
+rv=-1;
+ goto fail_kdf_ctx_new;
  }
 
 if (EVP_KDF_derive(kctx, dest, destlen, params) <= 0) {
 rv=-1;
  }
 
 EVP_KDF_CTX_free(kctx);
+fail_kdf_ctx_new:
+crypto_kdf_hkdf_free(kdf);
 
 returnrv;
 #else/* !(OPENSSL_VERSION_NUMBER >= 0x30000000L) */

deps/ngtcp2/ngtcp2/crypto/boringssl/boringssl.c

@@ -278,33 +278,44 @@ int ngtcp2_crypto_cipher_ctx_encrypt_init(ngtcp2_crypto_cipher_ctx *cipher_ctx,
 constuint8_t*key) {
 ngtcp2_crypto_boringssl_cipher*hp_cipher=cipher->native_handle;
 ngtcp2_crypto_boringssl_cipher_ctx*ctx;
-intrv;
- (void)rv;
+intrv=0;
 
 ctx=malloc(sizeof(*ctx));
 if (ctx==NULL) {
 return-1;
  }
 
-ctx->type=hp_cipher->type;
-cipher_ctx->native_handle=ctx;
-
 switch (hp_cipher->type) {
 caseNGTCP2_CRYPTO_BORINGSSL_CIPHER_TYPE_AES_128:
-rv=AES_set_encrypt_key(key, 128, &ctx->aes_key);
-assert(0==rv);
-return0;
+if (AES_set_encrypt_key(key, 128, &ctx->aes_key) !=0) {
+rv=-1;
+ }
+
+break;
 caseNGTCP2_CRYPTO_BORINGSSL_CIPHER_TYPE_AES_256:
-rv=AES_set_encrypt_key(key, 256, &ctx->aes_key);
-assert(0==rv);
-return0;
+if (AES_set_encrypt_key(key, 256, &ctx->aes_key) !=0) {
+rv=-1;
+ }
+
+break;
 caseNGTCP2_CRYPTO_BORINGSSL_CIPHER_TYPE_CHACHA20:
 memcpy(ctx->key, key, sizeof(ctx->key));
-return0;
+break;
 default:
 assert(0);
 abort();
  };
+
+if (rv!=0) {
+free(ctx);
+
+returnrv;
+ }
+
+ctx->type=hp_cipher->type;
+cipher_ctx->native_handle=ctx;
+
+return0;
 }
 
 voidngtcp2_crypto_cipher_ctx_free(ngtcp2_crypto_cipher_ctx*cipher_ctx) {

deps/ngtcp2/ngtcp2/crypto/ossl/ossl.c

@@ -730,8 +730,8 @@ int ngtcp2_crypto_hkdf_extract(uint8_t *dest, const ngtcp2_crypto_md *md,
 constuint8_t*secret, size_tsecretlen,
 constuint8_t*salt, size_tsaltlen) {
 constEVP_MD*prf=md->native_handle;
-EVP_KDF*kdf=crypto_kdf_hkdf();
-EVP_KDF_CTX*kctx=EVP_KDF_CTX_new(kdf);
+EVP_KDF*kdf;
+EVP_KDF_CTX*kctx;
 intmode=EVP_KDF_HKDF_MODE_EXTRACT_ONLY;
 OSSL_PARAMparams[] = {
 OSSL_PARAM_construct_int(OSSL_KDF_PARAM_MODE, &mode),
@@ -745,13 +745,24 @@ int ngtcp2_crypto_hkdf_extract(uint8_t *dest, const ngtcp2_crypto_md *md,
  };
 intrv=0;
 
-crypto_kdf_hkdf_free(kdf);
+kdf=crypto_kdf_hkdf();
+if (!kdf) {
+return-1;
+ }
+
+kctx=EVP_KDF_CTX_new(kdf);
+if (!kctx) {
+rv=-1;
+ goto fail_kdf_ctx_new;
+ }
 
 if (EVP_KDF_derive(kctx, dest, (size_t)EVP_MD_size(prf), params) <= 0) {
 rv=-1;
  }
 
 EVP_KDF_CTX_free(kctx);
+fail_kdf_ctx_new:
+crypto_kdf_hkdf_free(kdf);
 
 returnrv;
 }
@@ -761,8 +772,8 @@ int ngtcp2_crypto_hkdf_expand(uint8_t *dest, size_t destlen,
 size_tsecretlen, constuint8_t*info,
 size_tinfolen) {
 constEVP_MD*prf=md->native_handle;
-EVP_KDF*kdf=crypto_kdf_hkdf();
-EVP_KDF_CTX*kctx=EVP_KDF_CTX_new(kdf);
+EVP_KDF*kdf;
+EVP_KDF_CTX*kctx;
 intmode=EVP_KDF_HKDF_MODE_EXPAND_ONLY;
 OSSL_PARAMparams[] = {
 OSSL_PARAM_construct_int(OSSL_KDF_PARAM_MODE, &mode),
@@ -776,13 +787,24 @@ int ngtcp2_crypto_hkdf_expand(uint8_t *dest, size_t destlen,
  };
 intrv=0;
 
-crypto_kdf_hkdf_free(kdf);
+kdf=crypto_kdf_hkdf();
+if (!kdf) {
+return-1;
+ }
+
+kctx=EVP_KDF_CTX_new(kdf);
+if (!kctx) {
+rv=-1;
+ goto fail_kdf_ctx_new;
+ }
 
 if (EVP_KDF_derive(kctx, dest, destlen, params) <= 0) {
 rv=-1;
  }
 
 EVP_KDF_CTX_free(kctx);
+fail_kdf_ctx_new:
+crypto_kdf_hkdf_free(kdf);
 
 returnrv;
 }
@@ -792,8 +814,8 @@ int ngtcp2_crypto_hkdf(uint8_t *dest, size_t destlen,
 size_tsecretlen, constuint8_t*salt, size_tsaltlen,
 constuint8_t*info, size_tinfolen) {
 constEVP_MD*prf=md->native_handle;
-EVP_KDF*kdf=crypto_kdf_hkdf();
-EVP_KDF_CTX*kctx=EVP_KDF_CTX_new(kdf);
+EVP_KDF*kdf;
+EVP_KDF_CTX*kctx;
 OSSL_PARAMparams[] = {
 OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
  (char*)EVP_MD_get0_name(prf), 0),
@@ -807,13 +829,24 @@ int ngtcp2_crypto_hkdf(uint8_t *dest, size_t destlen,
  };
 intrv=0;
 
-crypto_kdf_hkdf_free(kdf);
+kdf=crypto_kdf_hkdf();
+if (!kdf) {
+return-1;
+ }
+
+kctx=EVP_KDF_CTX_new(kdf);
+if (!kctx) {
+rv=-1;
+ goto fail_kdf_ctx_new;
+ }
 
 if (EVP_KDF_derive(kctx, dest, destlen, params) <= 0) {
 rv=-1;
  }
 
 EVP_KDF_CTX_free(kctx);
+fail_kdf_ctx_new:
+crypto_kdf_hkdf_free(kdf);
 
 returnrv;
 }

deps/ngtcp2/ngtcp2/crypto/quictls/quictls.c

@@ -44,7 +44,6 @@
 #include"shared.h"
 
 #ifOPENSSL_VERSION_NUMBER >= 0x30000000L
-staticintcrypto_initialized;
 staticEVP_CIPHER*crypto_aes_128_gcm;
 staticEVP_CIPHER*crypto_aes_256_gcm;
 staticEVP_CIPHER*crypto_chacha20_poly1305;
@@ -57,57 +56,19 @@ static EVP_MD *crypto_sha384;
 staticEVP_KDF*crypto_hkdf;
 
 intngtcp2_crypto_quictls_init(void) {
+/* We do not care whether the pre-fetch succeeds or not. If it
+ fails, it returns NULL, which is still the default value, and our
+ code should still work with it. */
 crypto_aes_128_gcm=EVP_CIPHER_fetch(NULL, "AES-128-GCM", NULL);
-if (crypto_aes_128_gcm==NULL) {
-return-1;
- }
-
 crypto_aes_256_gcm=EVP_CIPHER_fetch(NULL, "AES-256-GCM", NULL);
-if (crypto_aes_256_gcm==NULL) {
-return-1;
- }
-
 crypto_chacha20_poly1305=EVP_CIPHER_fetch(NULL, "ChaCha20-Poly1305", NULL);
-if (crypto_chacha20_poly1305==NULL) {
-return-1;
- }
-
 crypto_aes_128_ccm=EVP_CIPHER_fetch(NULL, "AES-128-CCM", NULL);
-if (crypto_aes_128_ccm==NULL) {
-return-1;
- }
-
 crypto_aes_128_ecb=EVP_CIPHER_fetch(NULL, "AES-128-ECB", NULL);
-if (crypto_aes_128_ecb==NULL) {
-return-1;
- }
-
 crypto_aes_256_ecb=EVP_CIPHER_fetch(NULL, "AES-256-ECB", NULL);
-if (crypto_aes_256_ecb==NULL) {
-return-1;
- }
-
 crypto_chacha20=EVP_CIPHER_fetch(NULL, "ChaCha20", NULL);
-if (crypto_chacha20==NULL) {
-return-1;
- }
-
 crypto_sha256=EVP_MD_fetch(NULL, "sha256", NULL);
-if (crypto_sha256==NULL) {
-return-1;
- }
-
 crypto_sha384=EVP_MD_fetch(NULL, "sha384", NULL);
-if (crypto_sha384==NULL) {
-return-1;
- }
-
 crypto_hkdf=EVP_KDF_fetch(NULL, "hkdf", NULL);
-if (crypto_hkdf==NULL) {
-return-1;
- }
-
-crypto_initialized=1;
 
 return0;
 }
@@ -191,6 +152,12 @@ static EVP_KDF *crypto_kdf_hkdf(void) {
 
 returnEVP_KDF_fetch(NULL, "hkdf", NULL);
 }
+
+staticvoidcrypto_kdf_hkdf_free(EVP_KDF*kdf) {
+if (kdf&&crypto_hkdf!=kdf) {
+EVP_KDF_free(kdf);
+ }
+}
 #else/* !(OPENSSL_VERSION_NUMBER >= 0x30000000L) */
 # definecrypto_aead_aes_128_gcm EVP_aes_128_gcm
 # definecrypto_aead_aes_256_gcm EVP_aes_256_gcm
@@ -524,8 +491,8 @@ int ngtcp2_crypto_hkdf_extract(uint8_t *dest, const ngtcp2_crypto_md *md,
 constuint8_t*salt, size_tsaltlen) {
 #ifOPENSSL_VERSION_NUMBER >= 0x30000000L
 constEVP_MD*prf=md->native_handle;
-EVP_KDF*kdf=crypto_kdf_hkdf();
-EVP_KDF_CTX*kctx=EVP_KDF_CTX_new(kdf);
+EVP_KDF*kdf;
+EVP_KDF_CTX*kctx;
 intmode=EVP_KDF_HKDF_MODE_EXTRACT_ONLY;
 OSSL_PARAMparams[] = {
 OSSL_PARAM_construct_int(OSSL_KDF_PARAM_MODE, &mode),
@@ -539,15 +506,24 @@ int ngtcp2_crypto_hkdf_extract(uint8_t *dest, const ngtcp2_crypto_md *md,
  };
 intrv=0;
 
-if (!crypto_initialized) {
-EVP_KDF_free(kdf);
+kdf=crypto_kdf_hkdf();
+if (!kdf) {
+return-1;
+ }
+
+kctx=EVP_KDF_CTX_new(kdf);
+if (!kctx) {
+rv=-1;
+ goto fail_kdf_ctx_new;
  }
 
 if (EVP_KDF_derive(kctx, dest, (size_t)EVP_MD_size(prf), params) <= 0) {
 rv=-1;
  }
 
 EVP_KDF_CTX_free(kctx);
+fail_kdf_ctx_new:
+crypto_kdf_hkdf_free(kdf);
 
 returnrv;
 #else/* !(OPENSSL_VERSION_NUMBER >= 0x30000000L) */
@@ -581,8 +557,8 @@ int ngtcp2_crypto_hkdf_expand(uint8_t *dest, size_t destlen,
 size_tinfolen) {
 #ifOPENSSL_VERSION_NUMBER >= 0x30000000L
 constEVP_MD*prf=md->native_handle;
-EVP_KDF*kdf=crypto_kdf_hkdf();
-EVP_KDF_CTX*kctx=EVP_KDF_CTX_new(kdf);
+EVP_KDF*kdf;
+EVP_KDF_CTX*kctx;
 intmode=EVP_KDF_HKDF_MODE_EXPAND_ONLY;
 OSSL_PARAMparams[] = {
 OSSL_PARAM_construct_int(OSSL_KDF_PARAM_MODE, &mode),
@@ -596,15 +572,24 @@ int ngtcp2_crypto_hkdf_expand(uint8_t *dest, size_t destlen,
  };
 intrv=0;
 
-if (!crypto_initialized) {
-EVP_KDF_free(kdf);
+kdf=crypto_kdf_hkdf();
+if (!kdf) {
+return-1;
+ }
+
+kctx=EVP_KDF_CTX_new(kdf);
+if (!kctx) {
+rv=-1;
+ goto fail_kdf_ctx_new;
  }
 
 if (EVP_KDF_derive(kctx, dest, destlen, params) <= 0) {
 rv=-1;
  }
 
 EVP_KDF_CTX_free(kctx);
+fail_kdf_ctx_new:
+crypto_kdf_hkdf_free(kdf);
 
 returnrv;
 #else/* !(OPENSSL_VERSION_NUMBER >= 0x30000000L) */
@@ -637,8 +622,8 @@ int ngtcp2_crypto_hkdf(uint8_t *dest, size_t destlen,
 constuint8_t*info, size_tinfolen) {
 #ifOPENSSL_VERSION_NUMBER >= 0x30000000L
 constEVP_MD*prf=md->native_handle;
-EVP_KDF*kdf=crypto_kdf_hkdf();
-EVP_KDF_CTX*kctx=EVP_KDF_CTX_new(kdf);
+EVP_KDF*kdf;
+EVP_KDF_CTX*kctx;
 OSSL_PARAMparams[] = {
 OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
  (char*)EVP_MD_get0_name(prf), 0),
@@ -652,15 +637,24 @@ int ngtcp2_crypto_hkdf(uint8_t *dest, size_t destlen,
  };
 intrv=0;
 
-if (!crypto_initialized) {
-EVP_KDF_free(kdf);
+kdf=crypto_kdf_hkdf();
+if (!kdf) {
+return-1;
+ }
+
+kctx=EVP_KDF_CTX_new(kdf);
+if (!kctx) {
+rv=-1;
+ goto fail_kdf_ctx_new;
  }
 
 if (EVP_KDF_derive(kctx, dest, destlen, params) <= 0) {
 rv=-1;
  }
 
 EVP_KDF_CTX_free(kctx);
+fail_kdf_ctx_new:
+crypto_kdf_hkdf_free(kdf);
 
 returnrv;
 #else/* !(OPENSSL_VERSION_NUMBER >= 0x30000000L) */

deps/ngtcp2/ngtcp2/crypto/boringssl/boringssl.c

@@ -278,33 +278,44 @@ int ngtcp2_crypto_cipher_ctx_encrypt_init(ngtcp2_crypto_cipher_ctx *cipher_ctx,
 constuint8_t*key) {
 ngtcp2_crypto_boringssl_cipher*hp_cipher=cipher->native_handle;
 ngtcp2_crypto_boringssl_cipher_ctx*ctx;
-intrv;
- (void)rv;
+intrv=0;
 
 ctx=malloc(sizeof(*ctx));
 if (ctx==NULL) {
 return-1;
  }
 
-ctx->type=hp_cipher->type;
-cipher_ctx->native_handle=ctx;
-
 switch (hp_cipher->type) {
 caseNGTCP2_CRYPTO_BORINGSSL_CIPHER_TYPE_AES_128:
-rv=AES_set_encrypt_key(key, 128, &ctx->aes_key);
-assert(0==rv);
-return0;
+if (AES_set_encrypt_key(key, 128, &ctx->aes_key) !=0) {
+rv=-1;
+ }
+
+break;
 caseNGTCP2_CRYPTO_BORINGSSL_CIPHER_TYPE_AES_256:
-rv=AES_set_encrypt_key(key, 256, &ctx->aes_key);
-assert(0==rv);
-return0;
+if (AES_set_encrypt_key(key, 256, &ctx->aes_key) !=0) {
+rv=-1;
+ }
+
+break;
 caseNGTCP2_CRYPTO_BORINGSSL_CIPHER_TYPE_CHACHA20:
 memcpy(ctx->key, key, sizeof(ctx->key));
-return0;
+break;
 default:
 assert(0);
 abort();
  };
+
+if (rv!=0) {
+free(ctx);
+
+returnrv;
+ }
+
+ctx->type=hp_cipher->type;
+cipher_ctx->native_handle=ctx;
+
+return0;
 }
 
 voidngtcp2_crypto_cipher_ctx_free(ngtcp2_crypto_cipher_ctx*cipher_ctx) {

deps/ngtcp2/ngtcp2/crypto/ossl/ossl.c

@@ -730,8 +730,8 @@ int ngtcp2_crypto_hkdf_extract(uint8_t *dest, const ngtcp2_crypto_md *md,
 constuint8_t*secret, size_tsecretlen,
 constuint8_t*salt, size_tsaltlen) {
 constEVP_MD*prf=md->native_handle;
-EVP_KDF*kdf=crypto_kdf_hkdf();
-EVP_KDF_CTX*kctx=EVP_KDF_CTX_new(kdf);
+EVP_KDF*kdf;
+EVP_KDF_CTX*kctx;
 intmode=EVP_KDF_HKDF_MODE_EXTRACT_ONLY;
 OSSL_PARAMparams[] = {
 OSSL_PARAM_construct_int(OSSL_KDF_PARAM_MODE, &mode),
@@ -745,13 +745,24 @@ int ngtcp2_crypto_hkdf_extract(uint8_t *dest, const ngtcp2_crypto_md *md,
  };
 intrv=0;
 
-crypto_kdf_hkdf_free(kdf);
+kdf=crypto_kdf_hkdf();
+if (!kdf) {
+return-1;
+ }
+
+kctx=EVP_KDF_CTX_new(kdf);
+if (!kctx) {
+rv=-1;
+ goto fail_kdf_ctx_new;
+ }
 
 if (EVP_KDF_derive(kctx, dest, (size_t)EVP_MD_size(prf), params) <= 0) {
 rv=-1;
  }
 
 EVP_KDF_CTX_free(kctx);
+fail_kdf_ctx_new:
+crypto_kdf_hkdf_free(kdf);
 
 returnrv;
 }
@@ -761,8 +772,8 @@ int ngtcp2_crypto_hkdf_expand(uint8_t *dest, size_t destlen,
 size_tsecretlen, constuint8_t*info,
 size_tinfolen) {
 constEVP_MD*prf=md->native_handle;
-EVP_KDF*kdf=crypto_kdf_hkdf();
-EVP_KDF_CTX*kctx=EVP_KDF_CTX_new(kdf);
+EVP_KDF*kdf;
+EVP_KDF_CTX*kctx;
 intmode=EVP_KDF_HKDF_MODE_EXPAND_ONLY;
 OSSL_PARAMparams[] = {
 OSSL_PARAM_construct_int(OSSL_KDF_PARAM_MODE, &mode),
@@ -776,13 +787,24 @@ int ngtcp2_crypto_hkdf_expand(uint8_t *dest, size_t destlen,
  };
 intrv=0;
 
-crypto_kdf_hkdf_free(kdf);
+kdf=crypto_kdf_hkdf();
+if (!kdf) {
+return-1;
+ }
+
+kctx=EVP_KDF_CTX_new(kdf);
+if (!kctx) {
+rv=-1;
+ goto fail_kdf_ctx_new;
+ }
 
 if (EVP_KDF_derive(kctx, dest, destlen, params) <= 0) {
 rv=-1;
  }
 
 EVP_KDF_CTX_free(kctx);
+fail_kdf_ctx_new:
+crypto_kdf_hkdf_free(kdf);
 
 returnrv;
 }
@@ -792,8 +814,8 @@ int ngtcp2_crypto_hkdf(uint8_t *dest, size_t destlen,
 size_tsecretlen, constuint8_t*salt, size_tsaltlen,
 constuint8_t*info, size_tinfolen) {
 constEVP_MD*prf=md->native_handle;
-EVP_KDF*kdf=crypto_kdf_hkdf();
-EVP_KDF_CTX*kctx=EVP_KDF_CTX_new(kdf);
+EVP_KDF*kdf;
+EVP_KDF_CTX*kctx;
 OSSL_PARAMparams[] = {
 OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
  (char*)EVP_MD_get0_name(prf), 0),
@@ -807,13 +829,24 @@ int ngtcp2_crypto_hkdf(uint8_t *dest, size_t destlen,
  };
 intrv=0;
 
-crypto_kdf_hkdf_free(kdf);
+kdf=crypto_kdf_hkdf();
+if (!kdf) {
+return-1;
+ }
+
+kctx=EVP_KDF_CTX_new(kdf);
+if (!kctx) {
+rv=-1;
+ goto fail_kdf_ctx_new;
+ }
 
 if (EVP_KDF_derive(kctx, dest, destlen, params) <= 0) {
 rv=-1;
  }
 
 EVP_KDF_CTX_free(kctx);
+fail_kdf_ctx_new:
+crypto_kdf_hkdf_free(kdf);
 
 returnrv;
 }

deps/ngtcp2/ngtcp2/crypto/quictls/quictls.c

@@ -44,7 +44,6 @@
 #include"shared.h"
 
 #ifOPENSSL_VERSION_NUMBER >= 0x30000000L
-staticintcrypto_initialized;
 staticEVP_CIPHER*crypto_aes_128_gcm;
 staticEVP_CIPHER*crypto_aes_256_gcm;
 staticEVP_CIPHER*crypto_chacha20_poly1305;
@@ -57,57 +56,19 @@ static EVP_MD *crypto_sha384;
 staticEVP_KDF*crypto_hkdf;
 
 intngtcp2_crypto_quictls_init(void) {
+/* We do not care whether the pre-fetch succeeds or not. If it
+ fails, it returns NULL, which is still the default value, and our
+ code should still work with it. */
 crypto_aes_128_gcm=EVP_CIPHER_fetch(NULL, "AES-128-GCM", NULL);
-if (crypto_aes_128_gcm==NULL) {
-return-1;
- }
-
 crypto_aes_256_gcm=EVP_CIPHER_fetch(NULL, "AES-256-GCM", NULL);
-if (crypto_aes_256_gcm==NULL) {
-return-1;
- }
-
 crypto_chacha20_poly1305=EVP_CIPHER_fetch(NULL, "ChaCha20-Poly1305", NULL);
-if (crypto_chacha20_poly1305==NULL) {
-return-1;
- }
-
 crypto_aes_128_ccm=EVP_CIPHER_fetch(NULL, "AES-128-CCM", NULL);
-if (crypto_aes_128_ccm==NULL) {
-return-1;
- }
-
 crypto_aes_128_ecb=EVP_CIPHER_fetch(NULL, "AES-128-ECB", NULL);
-if (crypto_aes_128_ecb==NULL) {
-return-1;
- }
-
 crypto_aes_256_ecb=EVP_CIPHER_fetch(NULL, "AES-256-ECB", NULL);
-if (crypto_aes_256_ecb==NULL) {
-return-1;
- }
-
 crypto_chacha20=EVP_CIPHER_fetch(NULL, "ChaCha20", NULL);
-if (crypto_chacha20==NULL) {
-return-1;
- }
-
 crypto_sha256=EVP_MD_fetch(NULL, "sha256", NULL);
-if (crypto_sha256==NULL) {
-return-1;
- }
-
 crypto_sha384=EVP_MD_fetch(NULL, "sha384", NULL);
-if (crypto_sha384==NULL) {
-return-1;
- }
-
 crypto_hkdf=EVP_KDF_fetch(NULL, "hkdf", NULL);
-if (crypto_hkdf==NULL) {
-return-1;
- }
-
-crypto_initialized=1;
 
 return0;
 }
@@ -191,6 +152,12 @@ static EVP_KDF *crypto_kdf_hkdf(void) {
 
 returnEVP_KDF_fetch(NULL, "hkdf", NULL);
 }
+
+staticvoidcrypto_kdf_hkdf_free(EVP_KDF*kdf) {
+if (kdf&&crypto_hkdf!=kdf) {
+EVP_KDF_free(kdf);
+ }
+}
 #else/* !(OPENSSL_VERSION_NUMBER >= 0x30000000L) */
 # definecrypto_aead_aes_128_gcm EVP_aes_128_gcm
 # definecrypto_aead_aes_256_gcm EVP_aes_256_gcm
@@ -524,8 +491,8 @@ int ngtcp2_crypto_hkdf_extract(uint8_t *dest, const ngtcp2_crypto_md *md,
 constuint8_t*salt, size_tsaltlen) {
 #ifOPENSSL_VERSION_NUMBER >= 0x30000000L
 constEVP_MD*prf=md->native_handle;
-EVP_KDF*kdf=crypto_kdf_hkdf();
-EVP_KDF_CTX*kctx=EVP_KDF_CTX_new(kdf);
+EVP_KDF*kdf;
+EVP_KDF_CTX*kctx;
 intmode=EVP_KDF_HKDF_MODE_EXTRACT_ONLY;
 OSSL_PARAMparams[] = {
 OSSL_PARAM_construct_int(OSSL_KDF_PARAM_MODE, &mode),
@@ -539,15 +506,24 @@ int ngtcp2_crypto_hkdf_extract(uint8_t *dest, const ngtcp2_crypto_md *md,
  };
 intrv=0;
 
-if (!crypto_initialized) {
-EVP_KDF_free(kdf);
+kdf=crypto_kdf_hkdf();
+if (!kdf) {
+return-1;
+ }
+
+kctx=EVP_KDF_CTX_new(kdf);
+if (!kctx) {
+rv=-1;
+ goto fail_kdf_ctx_new;
  }
 
 if (EVP_KDF_derive(kctx, dest, (size_t)EVP_MD_size(prf), params) <= 0) {
 rv=-1;
  }
 
 EVP_KDF_CTX_free(kctx);
+fail_kdf_ctx_new:
+crypto_kdf_hkdf_free(kdf);
 
 returnrv;
 #else/* !(OPENSSL_VERSION_NUMBER >= 0x30000000L) */
@@ -581,8 +557,8 @@ int ngtcp2_crypto_hkdf_expand(uint8_t *dest, size_t destlen,
 size_tinfolen) {
 #ifOPENSSL_VERSION_NUMBER >= 0x30000000L
 constEVP_MD*prf=md->native_handle;
-EVP_KDF*kdf=crypto_kdf_hkdf();
-EVP_KDF_CTX*kctx=EVP_KDF_CTX_new(kdf);
+EVP_KDF*kdf;
+EVP_KDF_CTX*kctx;
 intmode=EVP_KDF_HKDF_MODE_EXPAND_ONLY;
 OSSL_PARAMparams[] = {
 OSSL_PARAM_construct_int(OSSL_KDF_PARAM_MODE, &mode),
@@ -596,15 +572,24 @@ int ngtcp2_crypto_hkdf_expand(uint8_t *dest, size_t destlen,
  };
 intrv=0;
 
-if (!crypto_initialized) {
-EVP_KDF_free(kdf);
+kdf=crypto_kdf_hkdf();
+if (!kdf) {
+return-1;
+ }
+
+kctx=EVP_KDF_CTX_new(kdf);
+if (!kctx) {
+rv=-1;
+ goto fail_kdf_ctx_new;
  }
 
 if (EVP_KDF_derive(kctx, dest, destlen, params) <= 0) {
 rv=-1;
  }
 
 EVP_KDF_CTX_free(kctx);
+fail_kdf_ctx_new:
+crypto_kdf_hkdf_free(kdf);
 
 returnrv;
 #else/* !(OPENSSL_VERSION_NUMBER >= 0x30000000L) */
@@ -637,8 +622,8 @@ int ngtcp2_crypto_hkdf(uint8_t *dest, size_t destlen,
 constuint8_t*info, size_tinfolen) {
 #ifOPENSSL_VERSION_NUMBER >= 0x30000000L
 constEVP_MD*prf=md->native_handle;
-EVP_KDF*kdf=crypto_kdf_hkdf();
-EVP_KDF_CTX*kctx=EVP_KDF_CTX_new(kdf);
+EVP_KDF*kdf;
+EVP_KDF_CTX*kctx;
 OSSL_PARAMparams[] = {
 OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
  (char*)EVP_MD_get0_name(prf), 0),
@@ -652,15 +637,24 @@ int ngtcp2_crypto_hkdf(uint8_t *dest, size_t destlen,
  };
 intrv=0;
 
-if (!crypto_initialized) {
-EVP_KDF_free(kdf);
+kdf=crypto_kdf_hkdf();
+if (!kdf) {
+return-1;
+ }
+
+kctx=EVP_KDF_CTX_new(kdf);
+if (!kctx) {
+rv=-1;
+ goto fail_kdf_ctx_new;
  }
 
 if (EVP_KDF_derive(kctx, dest, destlen, params) <= 0) {
 rv=-1;
  }
 
 EVP_KDF_CTX_free(kctx);
+fail_kdf_ctx_new:
+crypto_kdf_hkdf_free(kdf);
 
 returnrv;
 #else/* !(OPENSSL_VERSION_NUMBER >= 0x30000000L) */

deps/ngtcp2/ngtcp2/crypto/boringssl/boringssl.c

@@ -278,33 +278,44 @@ int ngtcp2_crypto_cipher_ctx_encrypt_init(ngtcp2_crypto_cipher_ctx *cipher_ctx,
 constuint8_t*key) {
 ngtcp2_crypto_boringssl_cipher*hp_cipher=cipher->native_handle;
 ngtcp2_crypto_boringssl_cipher_ctx*ctx;
-intrv;
- (void)rv;
+intrv=0;
 
 ctx=malloc(sizeof(*ctx));
 if (ctx==NULL) {
 return-1;
  }
 
-ctx->type=hp_cipher->type;
-cipher_ctx->native_handle=ctx;
-
 switch (hp_cipher->type) {
 caseNGTCP2_CRYPTO_BORINGSSL_CIPHER_TYPE_AES_128:
-rv=AES_set_encrypt_key(key, 128, &ctx->aes_key);
-assert(0==rv);
-return0;
+if (AES_set_encrypt_key(key, 128, &ctx->aes_key) !=0) {
+rv=-1;
+ }
+
+break;
 caseNGTCP2_CRYPTO_BORINGSSL_CIPHER_TYPE_AES_256:
-rv=AES_set_encrypt_key(key, 256, &ctx->aes_key);
-assert(0==rv);
-return0;
+if (AES_set_encrypt_key(key, 256, &ctx->aes_key) !=0) {
+rv=-1;
+ }
+
+break;
 caseNGTCP2_CRYPTO_BORINGSSL_CIPHER_TYPE_CHACHA20:
 memcpy(ctx->key, key, sizeof(ctx->key));
-return0;
+break;
 default:
 assert(0);
 abort();
  };
+
+if (rv!=0) {
+free(ctx);
+
+returnrv;
+ }
+
+ctx->type=hp_cipher->type;
+cipher_ctx->native_handle=ctx;
+
+return0;
 }
 
 voidngtcp2_crypto_cipher_ctx_free(ngtcp2_crypto_cipher_ctx*cipher_ctx) {

deps/ngtcp2/ngtcp2/crypto/ossl/ossl.c

@@ -730,8 +730,8 @@ int ngtcp2_crypto_hkdf_extract(uint8_t *dest, const ngtcp2_crypto_md *md,
 constuint8_t*secret, size_tsecretlen,
 constuint8_t*salt, size_tsaltlen) {
 constEVP_MD*prf=md->native_handle;
-EVP_KDF*kdf=crypto_kdf_hkdf();
-EVP_KDF_CTX*kctx=EVP_KDF_CTX_new(kdf);
+EVP_KDF*kdf;
+EVP_KDF_CTX*kctx;
 intmode=EVP_KDF_HKDF_MODE_EXTRACT_ONLY;
 OSSL_PARAMparams[] = {
 OSSL_PARAM_construct_int(OSSL_KDF_PARAM_MODE, &mode),
@@ -745,13 +745,24 @@ int ngtcp2_crypto_hkdf_extract(uint8_t *dest, const ngtcp2_crypto_md *md,
  };
 intrv=0;
 
-crypto_kdf_hkdf_free(kdf);
+kdf=crypto_kdf_hkdf();
+if (!kdf) {
+return-1;
+ }
+
+kctx=EVP_KDF_CTX_new(kdf);
+if (!kctx) {
+rv=-1;
+ goto fail_kdf_ctx_new;
+ }
 
 if (EVP_KDF_derive(kctx, dest, (size_t)EVP_MD_size(prf), params) <= 0) {
 rv=-1;
  }
 
 EVP_KDF_CTX_free(kctx);
+fail_kdf_ctx_new:
+crypto_kdf_hkdf_free(kdf);
 
 returnrv;
 }
@@ -761,8 +772,8 @@ int ngtcp2_crypto_hkdf_expand(uint8_t *dest, size_t destlen,
 size_tsecretlen, constuint8_t*info,
 size_tinfolen) {
 constEVP_MD*prf=md->native_handle;
-EVP_KDF*kdf=crypto_kdf_hkdf();
-EVP_KDF_CTX*kctx=EVP_KDF_CTX_new(kdf);
+EVP_KDF*kdf;
+EVP_KDF_CTX*kctx;
 intmode=EVP_KDF_HKDF_MODE_EXPAND_ONLY;
 OSSL_PARAMparams[] = {
 OSSL_PARAM_construct_int(OSSL_KDF_PARAM_MODE, &mode),
@@ -776,13 +787,24 @@ int ngtcp2_crypto_hkdf_expand(uint8_t *dest, size_t destlen,
  };
 intrv=0;
 
-crypto_kdf_hkdf_free(kdf);
+kdf=crypto_kdf_hkdf();
+if (!kdf) {
+return-1;
+ }
+
+kctx=EVP_KDF_CTX_new(kdf);
+if (!kctx) {
+rv=-1;
+ goto fail_kdf_ctx_new;
+ }
 
 if (EVP_KDF_derive(kctx, dest, destlen, params) <= 0) {
 rv=-1;
  }
 
 EVP_KDF_CTX_free(kctx);
+fail_kdf_ctx_new:
+crypto_kdf_hkdf_free(kdf);
 
 returnrv;
 }
@@ -792,8 +814,8 @@ int ngtcp2_crypto_hkdf(uint8_t *dest, size_t destlen,
 size_tsecretlen, constuint8_t*salt, size_tsaltlen,
 constuint8_t*info, size_tinfolen) {
 constEVP_MD*prf=md->native_handle;
-EVP_KDF*kdf=crypto_kdf_hkdf();
-EVP_KDF_CTX*kctx=EVP_KDF_CTX_new(kdf);
+EVP_KDF*kdf;
+EVP_KDF_CTX*kctx;
 OSSL_PARAMparams[] = {
 OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
  (char*)EVP_MD_get0_name(prf), 0),
@@ -807,13 +829,24 @@ int ngtcp2_crypto_hkdf(uint8_t *dest, size_t destlen,
  };
 intrv=0;
 
-crypto_kdf_hkdf_free(kdf);
+kdf=crypto_kdf_hkdf();
+if (!kdf) {
+return-1;
+ }
+
+kctx=EVP_KDF_CTX_new(kdf);
+if (!kctx) {
+rv=-1;
+ goto fail_kdf_ctx_new;
+ }
 
 if (EVP_KDF_derive(kctx, dest, destlen, params) <= 0) {
 rv=-1;
  }
 
 EVP_KDF_CTX_free(kctx);
+fail_kdf_ctx_new:
+crypto_kdf_hkdf_free(kdf);
 
 returnrv;
 }

deps/ngtcp2/ngtcp2/crypto/quictls/quictls.c

@@ -44,7 +44,6 @@
 #include"shared.h"
 
 #ifOPENSSL_VERSION_NUMBER >= 0x30000000L
-staticintcrypto_initialized;
 staticEVP_CIPHER*crypto_aes_128_gcm;
 staticEVP_CIPHER*crypto_aes_256_gcm;
 staticEVP_CIPHER*crypto_chacha20_poly1305;
@@ -57,57 +56,19 @@ static EVP_MD *crypto_sha384;
 staticEVP_KDF*crypto_hkdf;
 
 intngtcp2_crypto_quictls_init(void) {
+/* We do not care whether the pre-fetch succeeds or not. If it
+ fails, it returns NULL, which is still the default value, and our
+ code should still work with it. */
 crypto_aes_128_gcm=EVP_CIPHER_fetch(NULL, "AES-128-GCM", NULL);
-if (crypto_aes_128_gcm==NULL) {
-return-1;
- }
-
 crypto_aes_256_gcm=EVP_CIPHER_fetch(NULL, "AES-256-GCM", NULL);
-if (crypto_aes_256_gcm==NULL) {
-return-1;
- }
-
 crypto_chacha20_poly1305=EVP_CIPHER_fetch(NULL, "ChaCha20-Poly1305", NULL);
-if (crypto_chacha20_poly1305==NULL) {
-return-1;
- }
-
 crypto_aes_128_ccm=EVP_CIPHER_fetch(NULL, "AES-128-CCM", NULL);
-if (crypto_aes_128_ccm==NULL) {
-return-1;
- }
-
 crypto_aes_128_ecb=EVP_CIPHER_fetch(NULL, "AES-128-ECB", NULL);
-if (crypto_aes_128_ecb==NULL) {
-return-1;
- }
-
 crypto_aes_256_ecb=EVP_CIPHER_fetch(NULL, "AES-256-ECB", NULL);
-if (crypto_aes_256_ecb==NULL) {
-return-1;
- }
-
 crypto_chacha20=EVP_CIPHER_fetch(NULL, "ChaCha20", NULL);
-if (crypto_chacha20==NULL) {
-return-1;
- }
-
 crypto_sha256=EVP_MD_fetch(NULL, "sha256", NULL);
-if (crypto_sha256==NULL) {
-return-1;
- }
-
 crypto_sha384=EVP_MD_fetch(NULL, "sha384", NULL);
-if (crypto_sha384==NULL) {
-return-1;
- }
-
 crypto_hkdf=EVP_KDF_fetch(NULL, "hkdf", NULL);
-if (crypto_hkdf==NULL) {
-return-1;
- }
-
-crypto_initialized=1;
 
 return0;
 }
@@ -191,6 +152,12 @@ static EVP_KDF *crypto_kdf_hkdf(void) {
 
 returnEVP_KDF_fetch(NULL, "hkdf", NULL);
 }
+
+staticvoidcrypto_kdf_hkdf_free(EVP_KDF*kdf) {
+if (kdf&&crypto_hkdf!=kdf) {
+EVP_KDF_free(kdf);
+ }
+}
 #else/* !(OPENSSL_VERSION_NUMBER >= 0x30000000L) */
 # definecrypto_aead_aes_128_gcm EVP_aes_128_gcm
 # definecrypto_aead_aes_256_gcm EVP_aes_256_gcm
@@ -524,8 +491,8 @@ int ngtcp2_crypto_hkdf_extract(uint8_t *dest, const ngtcp2_crypto_md *md,
 constuint8_t*salt, size_tsaltlen) {
 #ifOPENSSL_VERSION_NUMBER >= 0x30000000L
 constEVP_MD*prf=md->native_handle;
-EVP_KDF*kdf=crypto_kdf_hkdf();
-EVP_KDF_CTX*kctx=EVP_KDF_CTX_new(kdf);
+EVP_KDF*kdf;
+EVP_KDF_CTX*kctx;
 intmode=EVP_KDF_HKDF_MODE_EXTRACT_ONLY;
 OSSL_PARAMparams[] = {
 OSSL_PARAM_construct_int(OSSL_KDF_PARAM_MODE, &mode),
@@ -539,15 +506,24 @@ int ngtcp2_crypto_hkdf_extract(uint8_t *dest, const ngtcp2_crypto_md *md,
  };
 intrv=0;
 
-if (!crypto_initialized) {
-EVP_KDF_free(kdf);
+kdf=crypto_kdf_hkdf();
+if (!kdf) {
+return-1;
+ }
+
+kctx=EVP_KDF_CTX_new(kdf);
+if (!kctx) {
+rv=-1;
+ goto fail_kdf_ctx_new;
  }
 
 if (EVP_KDF_derive(kctx, dest, (size_t)EVP_MD_size(prf), params) <= 0) {
 rv=-1;
  }
 
 EVP_KDF_CTX_free(kctx);
+fail_kdf_ctx_new:
+crypto_kdf_hkdf_free(kdf);
 
 returnrv;
 #else/* !(OPENSSL_VERSION_NUMBER >= 0x30000000L) */
@@ -581,8 +557,8 @@ int ngtcp2_crypto_hkdf_expand(uint8_t *dest, size_t destlen,
 size_tinfolen) {
 #ifOPENSSL_VERSION_NUMBER >= 0x30000000L
 constEVP_MD*prf=md->native_handle;
-EVP_KDF*kdf=crypto_kdf_hkdf();
-EVP_KDF_CTX*kctx=EVP_KDF_CTX_new(kdf);
+EVP_KDF*kdf;
+EVP_KDF_CTX*kctx;
 intmode=EVP_KDF_HKDF_MODE_EXPAND_ONLY;
 OSSL_PARAMparams[] = {
 OSSL_PARAM_construct_int(OSSL_KDF_PARAM_MODE, &mode),
@@ -596,15 +572,24 @@ int ngtcp2_crypto_hkdf_expand(uint8_t *dest, size_t destlen,
  };
 intrv=0;
 
-if (!crypto_initialized) {
-EVP_KDF_free(kdf);
+kdf=crypto_kdf_hkdf();
+if (!kdf) {
+return-1;
+ }
+
+kctx=EVP_KDF_CTX_new(kdf);
+if (!kctx) {
+rv=-1;
+ goto fail_kdf_ctx_new;
  }
 
 if (EVP_KDF_derive(kctx, dest, destlen, params) <= 0) {
 rv=-1;
  }
 
 EVP_KDF_CTX_free(kctx);
+fail_kdf_ctx_new:
+crypto_kdf_hkdf_free(kdf);
 
 returnrv;
 #else/* !(OPENSSL_VERSION_NUMBER >= 0x30000000L) */
@@ -637,8 +622,8 @@ int ngtcp2_crypto_hkdf(uint8_t *dest, size_t destlen,
 constuint8_t*info, size_tinfolen) {
 #ifOPENSSL_VERSION_NUMBER >= 0x30000000L
 constEVP_MD*prf=md->native_handle;
-EVP_KDF*kdf=crypto_kdf_hkdf();
-EVP_KDF_CTX*kctx=EVP_KDF_CTX_new(kdf);
+EVP_KDF*kdf;
+EVP_KDF_CTX*kctx;
 OSSL_PARAMparams[] = {
 OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
  (char*)EVP_MD_get0_name(prf), 0),
@@ -652,15 +637,24 @@ int ngtcp2_crypto_hkdf(uint8_t *dest, size_t destlen,
  };
 intrv=0;
 
-if (!crypto_initialized) {
-EVP_KDF_free(kdf);
+kdf=crypto_kdf_hkdf();
+if (!kdf) {
+return-1;
+ }
+
+kctx=EVP_KDF_CTX_new(kdf);
+if (!kctx) {
+rv=-1;
+ goto fail_kdf_ctx_new;
  }
 
 if (EVP_KDF_derive(kctx, dest, destlen, params) <= 0) {
 rv=-1;
  }
 
 EVP_KDF_CTX_free(kctx);
+fail_kdf_ctx_new:
+crypto_kdf_hkdf_free(kdf);
 
 returnrv;
 #else/* !(OPENSSL_VERSION_NUMBER >= 0x30000000L) */

deps/ngtcp2/ngtcp2/crypto/boringssl/boringssl.c

@@ -278,33 +278,44 @@ int ngtcp2_crypto_cipher_ctx_encrypt_init(ngtcp2_crypto_cipher_ctx *cipher_ctx,
 constuint8_t*key) {
 ngtcp2_crypto_boringssl_cipher*hp_cipher=cipher->native_handle;
 ngtcp2_crypto_boringssl_cipher_ctx*ctx;
-intrv;
- (void)rv;
+intrv=0;
 
 ctx=malloc(sizeof(*ctx));
 if (ctx==NULL) {
 return-1;
  }
 
-ctx->type=hp_cipher->type;
-cipher_ctx->native_handle=ctx;
-
 switch (hp_cipher->type) {
 caseNGTCP2_CRYPTO_BORINGSSL_CIPHER_TYPE_AES_128:
-rv=AES_set_encrypt_key(key, 128, &ctx->aes_key);
-assert(0==rv);
-return0;
+if (AES_set_encrypt_key(key, 128, &ctx->aes_key) !=0) {
+rv=-1;
+ }
+
+break;
 caseNGTCP2_CRYPTO_BORINGSSL_CIPHER_TYPE_AES_256:
-rv=AES_set_encrypt_key(key, 256, &ctx->aes_key);
-assert(0==rv);
-return0;
+if (AES_set_encrypt_key(key, 256, &ctx->aes_key) !=0) {
+rv=-1;
+ }
+
+break;
 caseNGTCP2_CRYPTO_BORINGSSL_CIPHER_TYPE_CHACHA20:
 memcpy(ctx->key, key, sizeof(ctx->key));
-return0;
+break;
 default:
 assert(0);
 abort();
  };
+
+if (rv!=0) {
+free(ctx);
+
+returnrv;
+ }
+
+ctx->type=hp_cipher->type;
+cipher_ctx->native_handle=ctx;
+
+return0;
 }
 
 voidngtcp2_crypto_cipher_ctx_free(ngtcp2_crypto_cipher_ctx*cipher_ctx) {

deps/ngtcp2/ngtcp2/crypto/ossl/ossl.c

@@ -730,8 +730,8 @@ int ngtcp2_crypto_hkdf_extract(uint8_t *dest, const ngtcp2_crypto_md *md,
 constuint8_t*secret, size_tsecretlen,
 constuint8_t*salt, size_tsaltlen) {
 constEVP_MD*prf=md->native_handle;
-EVP_KDF*kdf=crypto_kdf_hkdf();
-EVP_KDF_CTX*kctx=EVP_KDF_CTX_new(kdf);
+EVP_KDF*kdf;
+EVP_KDF_CTX*kctx;
 intmode=EVP_KDF_HKDF_MODE_EXTRACT_ONLY;
 OSSL_PARAMparams[] = {
 OSSL_PARAM_construct_int(OSSL_KDF_PARAM_MODE, &mode),
@@ -745,13 +745,24 @@ int ngtcp2_crypto_hkdf_extract(uint8_t *dest, const ngtcp2_crypto_md *md,
  };
 intrv=0;
 
-crypto_kdf_hkdf_free(kdf);
+kdf=crypto_kdf_hkdf();
+if (!kdf) {
+return-1;
+ }
+
+kctx=EVP_KDF_CTX_new(kdf);
+if (!kctx) {
+rv=-1;
+ goto fail_kdf_ctx_new;
+ }
 
 if (EVP_KDF_derive(kctx, dest, (size_t)EVP_MD_size(prf), params) <= 0) {
 rv=-1;
  }
 
 EVP_KDF_CTX_free(kctx);
+fail_kdf_ctx_new:
+crypto_kdf_hkdf_free(kdf);
 
 returnrv;
 }
@@ -761,8 +772,8 @@ int ngtcp2_crypto_hkdf_expand(uint8_t *dest, size_t destlen,
 size_tsecretlen, constuint8_t*info,
 size_tinfolen) {
 constEVP_MD*prf=md->native_handle;
-EVP_KDF*kdf=crypto_kdf_hkdf();
-EVP_KDF_CTX*kctx=EVP_KDF_CTX_new(kdf);
+EVP_KDF*kdf;
+EVP_KDF_CTX*kctx;
 intmode=EVP_KDF_HKDF_MODE_EXPAND_ONLY;
 OSSL_PARAMparams[] = {
 OSSL_PARAM_construct_int(OSSL_KDF_PARAM_MODE, &mode),
@@ -776,13 +787,24 @@ int ngtcp2_crypto_hkdf_expand(uint8_t *dest, size_t destlen,
  };
 intrv=0;
 
-crypto_kdf_hkdf_free(kdf);
+kdf=crypto_kdf_hkdf();
+if (!kdf) {
+return-1;
+ }
+
+kctx=EVP_KDF_CTX_new(kdf);
+if (!kctx) {
+rv=-1;
+ goto fail_kdf_ctx_new;
+ }
 
 if (EVP_KDF_derive(kctx, dest, destlen, params) <= 0) {
 rv=-1;
  }
 
 EVP_KDF_CTX_free(kctx);
+fail_kdf_ctx_new:
+crypto_kdf_hkdf_free(kdf);
 
 returnrv;
 }
@@ -792,8 +814,8 @@ int ngtcp2_crypto_hkdf(uint8_t *dest, size_t destlen,
 size_tsecretlen, constuint8_t*salt, size_tsaltlen,
 constuint8_t*info, size_tinfolen) {
 constEVP_MD*prf=md->native_handle;
-EVP_KDF*kdf=crypto_kdf_hkdf();
-EVP_KDF_CTX*kctx=EVP_KDF_CTX_new(kdf);
+EVP_KDF*kdf;
+EVP_KDF_CTX*kctx;
 OSSL_PARAMparams[] = {
 OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
  (char*)EVP_MD_get0_name(prf), 0),
@@ -807,13 +829,24 @@ int ngtcp2_crypto_hkdf(uint8_t *dest, size_t destlen,
  };
 intrv=0;
 
-crypto_kdf_hkdf_free(kdf);
+kdf=crypto_kdf_hkdf();
+if (!kdf) {
+return-1;
+ }
+
+kctx=EVP_KDF_CTX_new(kdf);
+if (!kctx) {
+rv=-1;
+ goto fail_kdf_ctx_new;
+ }
 
 if (EVP_KDF_derive(kctx, dest, destlen, params) <= 0) {
 rv=-1;
  }
 
 EVP_KDF_CTX_free(kctx);
+fail_kdf_ctx_new:
+crypto_kdf_hkdf_free(kdf);
 
 returnrv;
 }

deps/ngtcp2/ngtcp2/crypto/quictls/quictls.c

@@ -44,7 +44,6 @@
 #include"shared.h"
 
 #ifOPENSSL_VERSION_NUMBER >= 0x30000000L
-staticintcrypto_initialized;
 staticEVP_CIPHER*crypto_aes_128_gcm;
 staticEVP_CIPHER*crypto_aes_256_gcm;
 staticEVP_CIPHER*crypto_chacha20_poly1305;
@@ -57,57 +56,19 @@ static EVP_MD *crypto_sha384;
 staticEVP_KDF*crypto_hkdf;
 
 intngtcp2_crypto_quictls_init(void) {
+/* We do not care whether the pre-fetch succeeds or not. If it
+ fails, it returns NULL, which is still the default value, and our
+ code should still work with it. */
 crypto_aes_128_gcm=EVP_CIPHER_fetch(NULL, "AES-128-GCM", NULL);
-if (crypto_aes_128_gcm==NULL) {
-return-1;
- }
-
 crypto_aes_256_gcm=EVP_CIPHER_fetch(NULL, "AES-256-GCM", NULL);
-if (crypto_aes_256_gcm==NULL) {
-return-1;
- }
-
 crypto_chacha20_poly1305=EVP_CIPHER_fetch(NULL, "ChaCha20-Poly1305", NULL);
-if (crypto_chacha20_poly1305==NULL) {
-return-1;
- }
-
 crypto_aes_128_ccm=EVP_CIPHER_fetch(NULL, "AES-128-CCM", NULL);
-if (crypto_aes_128_ccm==NULL) {
-return-1;
- }
-
 crypto_aes_128_ecb=EVP_CIPHER_fetch(NULL, "AES-128-ECB", NULL);
-if (crypto_aes_128_ecb==NULL) {
-return-1;
- }
-
 crypto_aes_256_ecb=EVP_CIPHER_fetch(NULL, "AES-256-ECB", NULL);
-if (crypto_aes_256_ecb==NULL) {
-return-1;
- }
-
 crypto_chacha20=EVP_CIPHER_fetch(NULL, "ChaCha20", NULL);
-if (crypto_chacha20==NULL) {
-return-1;
- }
-
 crypto_sha256=EVP_MD_fetch(NULL, "sha256", NULL);
-if (crypto_sha256==NULL) {
-return-1;
- }
-
 crypto_sha384=EVP_MD_fetch(NULL, "sha384", NULL);
-if (crypto_sha384==NULL) {
-return-1;
- }
-
 crypto_hkdf=EVP_KDF_fetch(NULL, "hkdf", NULL);
-if (crypto_hkdf==NULL) {
-return-1;
- }
-
-crypto_initialized=1;
 
 return0;
 }
@@ -191,6 +152,12 @@ static EVP_KDF *crypto_kdf_hkdf(void) {
 
 returnEVP_KDF_fetch(NULL, "hkdf", NULL);
 }
+
+staticvoidcrypto_kdf_hkdf_free(EVP_KDF*kdf) {
+if (kdf&&crypto_hkdf!=kdf) {
+EVP_KDF_free(kdf);
+ }
+}
 #else/* !(OPENSSL_VERSION_NUMBER >= 0x30000000L) */
 # definecrypto_aead_aes_128_gcm EVP_aes_128_gcm
 # definecrypto_aead_aes_256_gcm EVP_aes_256_gcm
@@ -524,8 +491,8 @@ int ngtcp2_crypto_hkdf_extract(uint8_t *dest, const ngtcp2_crypto_md *md,
 constuint8_t*salt, size_tsaltlen) {
 #ifOPENSSL_VERSION_NUMBER >= 0x30000000L
 constEVP_MD*prf=md->native_handle;
-EVP_KDF*kdf=crypto_kdf_hkdf();
-EVP_KDF_CTX*kctx=EVP_KDF_CTX_new(kdf);
+EVP_KDF*kdf;
+EVP_KDF_CTX*kctx;
 intmode=EVP_KDF_HKDF_MODE_EXTRACT_ONLY;
 OSSL_PARAMparams[] = {
 OSSL_PARAM_construct_int(OSSL_KDF_PARAM_MODE, &mode),
@@ -539,15 +506,24 @@ int ngtcp2_crypto_hkdf_extract(uint8_t *dest, const ngtcp2_crypto_md *md,
  };
 intrv=0;
 
-if (!crypto_initialized) {
-EVP_KDF_free(kdf);
+kdf=crypto_kdf_hkdf();
+if (!kdf) {
+return-1;
+ }
+
+kctx=EVP_KDF_CTX_new(kdf);
+if (!kctx) {
+rv=-1;
+ goto fail_kdf_ctx_new;
  }
 
 if (EVP_KDF_derive(kctx, dest, (size_t)EVP_MD_size(prf), params) <= 0) {
 rv=-1;
  }
 
 EVP_KDF_CTX_free(kctx);
+fail_kdf_ctx_new:
+crypto_kdf_hkdf_free(kdf);
 
 returnrv;
 #else/* !(OPENSSL_VERSION_NUMBER >= 0x30000000L) */
@@ -581,8 +557,8 @@ int ngtcp2_crypto_hkdf_expand(uint8_t *dest, size_t destlen,
 size_tinfolen) {
 #ifOPENSSL_VERSION_NUMBER >= 0x30000000L
 constEVP_MD*prf=md->native_handle;
-EVP_KDF*kdf=crypto_kdf_hkdf();
-EVP_KDF_CTX*kctx=EVP_KDF_CTX_new(kdf);
+EVP_KDF*kdf;
+EVP_KDF_CTX*kctx;
 intmode=EVP_KDF_HKDF_MODE_EXPAND_ONLY;
 OSSL_PARAMparams[] = {
 OSSL_PARAM_construct_int(OSSL_KDF_PARAM_MODE, &mode),
@@ -596,15 +572,24 @@ int ngtcp2_crypto_hkdf_expand(uint8_t *dest, size_t destlen,
  };
 intrv=0;
 
-if (!crypto_initialized) {
-EVP_KDF_free(kdf);
+kdf=crypto_kdf_hkdf();
+if (!kdf) {
+return-1;
+ }
+
+kctx=EVP_KDF_CTX_new(kdf);
+if (!kctx) {
+rv=-1;
+ goto fail_kdf_ctx_new;
  }
 
 if (EVP_KDF_derive(kctx, dest, destlen, params) <= 0) {
 rv=-1;
  }
 
 EVP_KDF_CTX_free(kctx);
+fail_kdf_ctx_new:
+crypto_kdf_hkdf_free(kdf);
 
 returnrv;
 #else/* !(OPENSSL_VERSION_NUMBER >= 0x30000000L) */
@@ -637,8 +622,8 @@ int ngtcp2_crypto_hkdf(uint8_t *dest, size_t destlen,
 constuint8_t*info, size_tinfolen) {
 #ifOPENSSL_VERSION_NUMBER >= 0x30000000L
 constEVP_MD*prf=md->native_handle;
-EVP_KDF*kdf=crypto_kdf_hkdf();
-EVP_KDF_CTX*kctx=EVP_KDF_CTX_new(kdf);
+EVP_KDF*kdf;
+EVP_KDF_CTX*kctx;
 OSSL_PARAMparams[] = {
 OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
  (char*)EVP_MD_get0_name(prf), 0),
@@ -652,15 +637,24 @@ int ngtcp2_crypto_hkdf(uint8_t *dest, size_t destlen,
  };
 intrv=0;
 
-if (!crypto_initialized) {
-EVP_KDF_free(kdf);
+kdf=crypto_kdf_hkdf();
+if (!kdf) {
+return-1;
+ }
+
+kctx=EVP_KDF_CTX_new(kdf);
+if (!kctx) {
+rv=-1;
+ goto fail_kdf_ctx_new;
  }
 
 if (EVP_KDF_derive(kctx, dest, destlen, params) <= 0) {
 rv=-1;
  }
 
 EVP_KDF_CTX_free(kctx);
+fail_kdf_ctx_new:
+crypto_kdf_hkdf_free(kdf);
 
 returnrv;
 #else/* !(OPENSSL_VERSION_NUMBER >= 0x30000000L) */