 @@ -1355,26 +1355,27 @@ void ERR_load_ASN1_strings(void);
 # define ASN1_R_INVALID_UTF8STRING                        134
 # define ASN1_R_IV_TOO_LARGE                              135
 # define ASN1_R_LENGTH_ERROR                              136
 # define ASN1_R_LIST_ERROR                                188
 # define ASN1_R_MIME_NO_CONTENT_TYPE                      206
 # define ASN1_R_MIME_PARSE_ERROR                          207
 # define ASN1_R_MIME_SIG_PARSE_ERROR                      208
 # define ASN1_R_MISSING_EOC                               137
 # define ASN1_R_MISSING_SECOND_NUMBER                     138
 # define ASN1_R_MISSING_VALUE                             189
 # define ASN1_R_MSTRING_NOT_UNIVERSAL                     139
 # define ASN1_R_MSTRING_WRONG_TAG                         140
 # define ASN1_R_NESTED_ASN1_STRING                        197
 # define ASN1_R_NESTED_TOO_DEEP                           219
 # define ASN1_R_NON_HEX_CHARACTERS                        141
 # define ASN1_R_NOT_ASCII_FORMAT                          190
 # define ASN1_R_NOT_ENOUGH_DATA                           142
 # define ASN1_R_NO_CONTENT_TYPE                           209
 # define ASN1_R_NO_DEFAULT_DIGEST                         201
 # define ASN1_R_NO_MATCHING_CHOICE_TYPE                   143
 # define ASN1_R_NO_MULTIPART_BODY_FAILURE                 210
 # define ASN1_R_NO_MULTIPART_BOUNDARY                     211
 # define ASN1_R_NO_SIG_CONTENT_TYPE                       212
 # define ASN1_R_NULL_IS_WRONG_LENGTH                      144
 # define ASN1_R_OBJECT_NOT_ASCII_FORMAT                   191
 # define ASN1_R_ODD_NUMBER_OF_CHARS                       145
 # define ASN1_R_PRIVATE_KEY_HEADER_MISSING                146

 @@ -1,16 +1,16 @@
 /* crypto/asn1/asn1_err.c */
 /* ====================================================================
- * Copyright (c) 1999-2014 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2018 The OpenSSL Project.  All rights reserved.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
+ *
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
+ *
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in
  *    the documentation and/or other materials provided with the
  *    distribution.
+ *
 @@ -269,26 +269,27 @@ static ERR_STRING_DATA ASN1_str_reasons[
     {ERR_REASON(ASN1_R_INVALID_UTF8STRING), "invalid utf8string"},
     {ERR_REASON(ASN1_R_IV_TOO_LARGE), "iv too large"},
     {ERR_REASON(ASN1_R_LENGTH_ERROR), "length error"},
     {ERR_REASON(ASN1_R_LIST_ERROR), "list error"},
     {ERR_REASON(ASN1_R_MIME_NO_CONTENT_TYPE), "mime no content type"},
     {ERR_REASON(ASN1_R_MIME_PARSE_ERROR), "mime parse error"},
     {ERR_REASON(ASN1_R_MIME_SIG_PARSE_ERROR), "mime sig parse error"},
     {ERR_REASON(ASN1_R_MISSING_EOC), "missing eoc"},
     {ERR_REASON(ASN1_R_MISSING_SECOND_NUMBER), "missing second number"},
     {ERR_REASON(ASN1_R_MISSING_VALUE), "missing value"},
     {ERR_REASON(ASN1_R_MSTRING_NOT_UNIVERSAL), "mstring not universal"},
     {ERR_REASON(ASN1_R_MSTRING_WRONG_TAG), "mstring wrong tag"},
     {ERR_REASON(ASN1_R_NESTED_ASN1_STRING), "nested asn1 string"},
     {ERR_REASON(ASN1_R_NESTED_TOO_DEEP), "nested too deep"},
     {ERR_REASON(ASN1_R_NON_HEX_CHARACTERS), "non hex characters"},
     {ERR_REASON(ASN1_R_NOT_ASCII_FORMAT), "not ascii format"},
     {ERR_REASON(ASN1_R_NOT_ENOUGH_DATA), "not enough data"},
     {ERR_REASON(ASN1_R_NO_CONTENT_TYPE), "no content type"},
     {ERR_REASON(ASN1_R_NO_DEFAULT_DIGEST), "no default digest"},
     {ERR_REASON(ASN1_R_NO_MATCHING_CHOICE_TYPE), "no matching choice type"},
     {ERR_REASON(ASN1_R_NO_MULTIPART_BODY_FAILURE),
      "no multipart body failure"},
     {ERR_REASON(ASN1_R_NO_MULTIPART_BOUNDARY), "no multipart boundary"},
     {ERR_REASON(ASN1_R_NO_SIG_CONTENT_TYPE), "no sig content type"},
     {ERR_REASON(ASN1_R_NULL_IS_WRONG_LENGTH), "null is wrong length"},
     {ERR_REASON(ASN1_R_OBJECT_NOT_ASCII_FORMAT), "object not ascii format"},
     {ERR_REASON(ASN1_R_ODD_NUMBER_OF_CHARS), "odd number of chars"},

 @@ -55,47 +55,55 @@
  * (eay@cryptsoft.com).  This product includes software written by Tim
  * Hudson (tjh@cryptsoft.com).
+ *
  */
 #include <stddef.h>
 #include <string.h>
 #include <openssl/asn1.h>
 #include <openssl/asn1t.h>
 #include <openssl/objects.h>
 #include <openssl/buffer.h>
 #include <openssl/err.h>
 /*
  * Constructed types with a recursive definition (such as can be found in PKCS7)
  * could eventually exceed the stack given malicious input with excessive
  * recursion. Therefore we limit the stack depth. This is the maximum number of
  * recursive invocations of asn1_item_embed_d2i().
  */
 #define ASN1_MAX_CONSTRUCTED_NEST 30
 static int asn1_check_eoc(const unsigned char **in, long len);
 static int asn1_find_end(const unsigned char **in, long len, char inf);
 static int asn1_collect(BUF_MEM *buf, const unsigned char **in, long len,
                         char inf, int tag, int aclass, int depth);
 static int collect_data(BUF_MEM *buf, const unsigned char **p, long plen);
 static int asn1_check_tlen(long *olen, int *otag, unsigned char *oclass,
                            char *inf, char *cst,
                            const unsigned char **in, long len,
                            int exptag, int expclass, char opt, ASN1_TLC *ctx);
 static int asn1_template_ex_d2i(ASN1_VALUE **pval,
                                 const unsigned char **in, long len,
                                 const ASN1_TEMPLATE *tt, char opt,
-                                ASN1_TLC *ctx);
+                                ASN1_TLC *ctx, int depth);
 static int asn1_template_noexp_d2i(ASN1_VALUE **val,
                                    const unsigned char **in, long len,
                                    const ASN1_TEMPLATE *tt, char opt,
-                                   ASN1_TLC *ctx);
+                                   ASN1_TLC *ctx, int depth);
 static int asn1_d2i_ex_primitive(ASN1_VALUE **pval,
                                  const unsigned char **in, long len,
                                  const ASN1_ITEM *it,
                                  int tag, int aclass, char opt,
                                  ASN1_TLC *ctx);
 /* Table to convert tags to bit values, used for MSTRING type */
 static const unsigned long tag2bit[32] = {
     /* tags  0 -  3 */
 , 0, 0, B_ASN1_BIT_STRING,
     /* tags  4- 7 */
     B_ASN1_OCTET_STRING, 0, 0, B_ASN1_UNKNOWN,
     /* tags  8-11 */
 @@ -144,77 +152,81 @@ ASN1_VALUE *ASN1_item_d2i(ASN1_VALUE **p
         pval = &ptmpval;
     asn1_tlc_clear_nc(&c);
     if (ASN1_item_ex_d2i(pval, in, len, it, -1, 0, 0, &c) > 0)
         return *pval;
     return NULL;
+}
 int ASN1_template_d2i(ASN1_VALUE **pval,
                       const unsigned char **in, long len,
                       const ASN1_TEMPLATE *tt)
+{
     ASN1_TLC c;
     asn1_tlc_clear_nc(&c);
-    return asn1_template_ex_d2i(pval, in, len, tt, 0, &c);
+    return asn1_template_ex_d2i(pval, in, len, tt, 0, &c, 0);
+}
 /*
  * Decode an item, taking care of IMPLICIT tagging, if any. If 'opt' set and
  * tag mismatch return -1 to handle OPTIONAL
  */
 static int asn1_item_ex_d2i(ASN1_VALUE **pval, const unsigned char **in,
-int ASN1_item_ex_d2i(ASN1_VALUE **pval, const unsigned char **in, long len,
+                            long len, const ASN1_ITEM *it, int tag, int aclass,
-                     const ASN1_ITEM *it,
+                            char opt, ASN1_TLC *ctx, int depth)
                      int tag, int aclass, char opt, ASN1_TLC *ctx)
+{
     const ASN1_TEMPLATE *tt, *errtt = NULL;
     const ASN1_COMPAT_FUNCS *cf;
     const ASN1_EXTERN_FUNCS *ef;
     const ASN1_AUX *aux = it->funcs;
     ASN1_aux_cb *asn1_cb;
     const unsigned char *p = NULL, *q;
     unsigned char *wp = NULL;   /* BIG FAT WARNING! BREAKS CONST WHERE USED */
     unsigned char imphack = 0, oclass;
     char seq_eoc, seq_nolen, cst, isopt;
     long tmplen;
     int i;
     int otag;
     int ret = 0;
     ASN1_VALUE **pchptr, *ptmpval;
     int combine = aclass & ASN1_TFLG_COMBINE;
     aclass &= ~ASN1_TFLG_COMBINE;
     if (!pval)
         return 0;
     if (aux && aux->asn1_cb)
         asn1_cb = aux->asn1_cb;
     else
         asn1_cb = 0;
     if (++depth > ASN1_MAX_CONSTRUCTED_NEST) {
         ASN1err(ASN1_F_ASN1_ITEM_EX_D2I, ASN1_R_NESTED_TOO_DEEP);
         goto err;
+    }
     switch (it->itype) {
     case ASN1_ITYPE_PRIMITIVE:
         if (it->templates) {
             /*
              * tagging or OPTIONAL is currently illegal on an item template
              * because the flags can't get passed down. In practice this
              * isn't a problem: we include the relevant flags from the item
              * template in the template itself.
              */
             if ((tag != -1) || opt) {
                 ASN1err(ASN1_F_ASN1_ITEM_EX_D2I,
                         ASN1_R_ILLEGAL_OPTIONS_ON_ITEM_TEMPLATE);
                 goto err;
+            }
             return asn1_template_ex_d2i(pval, in, len,
-                                        it->templates, opt, ctx);
+                                        it->templates, opt, ctx, depth);
+        }
         return asn1_d2i_ex_primitive(pval, in, len, it,
                                      tag, aclass, opt, ctx);
         break;
     case ASN1_ITYPE_MSTRING:
         p = *in;
         /* Just read in tag and class */
         ret = asn1_check_tlen(NULL, &otag, &oclass, NULL, NULL,
                               &p, len, -1, 0, 1, ctx);
         if (!ret) {
             ASN1err(ASN1_F_ASN1_ITEM_EX_D2I, ERR_R_NESTED_ASN1_ERROR);
             goto err;
 @@ -316,27 +328,27 @@ int ASN1_item_ex_d2i(ASN1_VALUE **pval,
                 asn1_set_choice_selector(pval, -1, it);
+            }
         } else if (!ASN1_item_ex_new(pval, it)) {
             ASN1err(ASN1_F_ASN1_ITEM_EX_D2I, ERR_R_NESTED_ASN1_ERROR);
             goto err;
+        }
         /* CHOICE type, try each possibility in turn */
         p = *in;
         for (i = 0, tt = it->templates; i < it->tcount; i++, tt++) {
             pchptr = asn1_get_field_ptr(pval, tt);
             /*
              * We mark field as OPTIONAL so its absence can be recognised.
              */
-            ret = asn1_template_ex_d2i(pchptr, &p, len, tt, 1, ctx);
+            ret = asn1_template_ex_d2i(pchptr, &p, len, tt, 1, ctx, depth);
             /* If field not present, try the next one */
             if (ret == -1)
                 continue;
             /* If positive return, read OK, break loop */
             if (ret > 0)
                 break;
             /* Otherwise must be an ASN1 parsing error */
             errtt = tt;
             ASN1err(ASN1_F_ASN1_ITEM_EX_D2I, ERR_R_NESTED_ASN1_ERROR);
             goto err;
+        }
         /* Did we fall off the end without reading anything? */
 @@ -434,27 +446,28 @@ int ASN1_item_ex_d2i(ASN1_VALUE **pval,
              * This determines the OPTIONAL flag value. The field cannot be
              * omitted if it is the last of a SEQUENCE and there is still
              * data to be read. This isn't strictly necessary but it
              * increases efficiency in some cases.
              */
             if (i == (it->tcount - 1))
                 isopt = 0;
             else
                 isopt = (char)(seqtt->flags & ASN1_TFLG_OPTIONAL);
             /*
              * attempt to read in field, allowing each to be OPTIONAL
              */
-            ret = asn1_template_ex_d2i(pseqval, &p, len, seqtt, isopt, ctx);
+            ret = asn1_template_ex_d2i(pseqval, &p, len, seqtt, isopt, ctx,
                                        depth);
             if (!ret) {
                 errtt = seqtt;
                 goto err;
             } else if (ret == -1) {
                 /*
                  * OPTIONAL component absent. Free and zero the field.
                  */
                 ASN1_template_free(pseqval, seqtt);
                 continue;
+            }
             /* Update length */
             len -= p - q;
+        }
 @@ -504,35 +517,42 @@ int ASN1_item_ex_d2i(ASN1_VALUE **pval,
  auxerr:
     ASN1err(ASN1_F_ASN1_ITEM_EX_D2I, ASN1_R_AUX_ERROR);
  err:
     if (combine == 0)
         ASN1_item_ex_free(pval, it);
     if (errtt)
         ERR_add_error_data(4, "Field=", errtt->field_name,
                            ", Type=", it->sname);
     else
         ERR_add_error_data(2, "Type=", it->sname);
     return 0;
+}
 int ASN1_item_ex_d2i(ASN1_VALUE **pval, const unsigned char **in, long len,
                      const ASN1_ITEM *it,
                      int tag, int aclass, char opt, ASN1_TLC *ctx)
+{
     return asn1_item_ex_d2i(pval, in, len, it, tag, aclass, opt, ctx, 0);
+}
 /*
  * Templates are handled with two separate functions. One handles any
  * EXPLICIT tag and the other handles the rest.
  */
 static int asn1_template_ex_d2i(ASN1_VALUE **val,
                                 const unsigned char **in, long inlen,
                                 const ASN1_TEMPLATE *tt, char opt,
-                                ASN1_TLC *ctx)
+                                ASN1_TLC *ctx, int depth)
+{
     int flags, aclass;
     int ret;
     long len;
     const unsigned char *p, *q;
     char exp_eoc;
     if (!val)
         return 0;
     flags = tt->flags;
     aclass = flags & ASN1_TFLG_TAG_CLASS;
     p = *in;
 @@ -547,64 +567,64 @@ static int asn1_template_ex_d2i(ASN1_VAL
                               &p, inlen, tt->tag, aclass, opt, ctx);
         q = p;
         if (!ret) {
             ASN1err(ASN1_F_ASN1_TEMPLATE_EX_D2I, ERR_R_NESTED_ASN1_ERROR);
             return 0;
         } else if (ret == -1)
             return -1;
         if (!cst) {
             ASN1err(ASN1_F_ASN1_TEMPLATE_EX_D2I,
                     ASN1_R_EXPLICIT_TAG_NOT_CONSTRUCTED);
             return 0;
+        }
         /* We've found the field so it can't be OPTIONAL now */
-        ret = asn1_template_noexp_d2i(val, &p, len, tt, 0, ctx);
+        ret = asn1_template_noexp_d2i(val, &p, len, tt, 0, ctx, depth);
         if (!ret) {
             ASN1err(ASN1_F_ASN1_TEMPLATE_EX_D2I, ERR_R_NESTED_ASN1_ERROR);
             return 0;
+        }
         /* We read the field in OK so update length */
         len -= p - q;
         if (exp_eoc) {
             /* If NDEF we must have an EOC here */
             if (!asn1_check_eoc(&p, len)) {
                 ASN1err(ASN1_F_ASN1_TEMPLATE_EX_D2I, ASN1_R_MISSING_EOC);
                 goto err;
+            }
         } else {
             /*
              * Otherwise we must hit the EXPLICIT tag end or its an error
              */
             if (len) {
                 ASN1err(ASN1_F_ASN1_TEMPLATE_EX_D2I,
                         ASN1_R_EXPLICIT_LENGTH_MISMATCH);
                 goto err;
+            }
+        }
     } else
-        return asn1_template_noexp_d2i(val, in, inlen, tt, opt, ctx);
+        return asn1_template_noexp_d2i(val, in, inlen, tt, opt, ctx, depth);
     *in = p;
     return 1;
  err:
     ASN1_template_free(val, tt);
     return 0;
+}
 static int asn1_template_noexp_d2i(ASN1_VALUE **val,
                                    const unsigned char **in, long len,
                                    const ASN1_TEMPLATE *tt, char opt,
-                                   ASN1_TLC *ctx)
+                                   ASN1_TLC *ctx, int depth)
+{
     int flags, aclass;
     int ret;
     const unsigned char *p, *q;
     if (!val)
         return 0;
     flags = tt->flags;
     aclass = flags & ASN1_TFLG_TAG_CLASS;
     p = *in;
     q = p;
     if (flags & ASN1_TFLG_SK_MASK) {
 @@ -655,56 +675,56 @@ static int asn1_template_noexp_d2i(ASN1_
             q = p;
             /* See if EOC found */
             if (asn1_check_eoc(&p, len)) {
                 if (!sk_eoc) {
                     ASN1err(ASN1_F_ASN1_TEMPLATE_NOEXP_D2I,
                             ASN1_R_UNEXPECTED_EOC);
                     goto err;
+                }
                 len -= p - q;
                 sk_eoc = 0;
                 break;
+            }
             skfield = NULL;
-            if (!ASN1_item_ex_d2i(&skfield, &p, len,
+            if (!asn1_item_ex_d2i(&skfield, &p, len, ASN1_ITEM_ptr(tt->item),
-                                  ASN1_ITEM_ptr(tt->item), -1, 0, 0, ctx)) {
+                                  -1, 0, 0, ctx, depth)) {
                 ASN1err(ASN1_F_ASN1_TEMPLATE_NOEXP_D2I,
                         ERR_R_NESTED_ASN1_ERROR);
                 goto err;
+            }
             len -= p - q;
             if (!sk_ASN1_VALUE_push((STACK_OF(ASN1_VALUE) *)*val, skfield)) {
                 ASN1err(ASN1_F_ASN1_TEMPLATE_NOEXP_D2I, ERR_R_MALLOC_FAILURE);
                 goto err;
+            }
+        }
         if (sk_eoc) {
             ASN1err(ASN1_F_ASN1_TEMPLATE_NOEXP_D2I, ASN1_R_MISSING_EOC);
             goto err;
+        }
     } else if (flags & ASN1_TFLG_IMPTAG) {
         /* IMPLICIT tagging */
-        ret = ASN1_item_ex_d2i(val, &p, len,
+        ret = asn1_item_ex_d2i(val, &p, len, ASN1_ITEM_ptr(tt->item), tt->tag,
-                               ASN1_ITEM_ptr(tt->item), tt->tag, aclass, opt,
+                               aclass, opt, ctx, depth);
                                ctx);
         if (!ret) {
             ASN1err(ASN1_F_ASN1_TEMPLATE_NOEXP_D2I, ERR_R_NESTED_ASN1_ERROR);
             goto err;
         } else if (ret == -1)
             return -1;
     } else {
         /* Nothing special */
-        ret = ASN1_item_ex_d2i(val, &p, len, ASN1_ITEM_ptr(tt->item),
+        ret = asn1_item_ex_d2i(val, &p, len, ASN1_ITEM_ptr(tt->item),
-                               -1, tt->flags & ASN1_TFLG_COMBINE, opt, ctx);
+                               -1, tt->flags & ASN1_TFLG_COMBINE, opt, ctx,
                                depth);
         if (!ret) {
             ASN1err(ASN1_F_ASN1_TEMPLATE_NOEXP_D2I, ERR_R_NESTED_ASN1_ERROR);
             goto err;
         } else if (ret == -1)
             return -1;
+    }
     *in = p;
     return 1;
  err:
     ASN1_template_free(val, tt);
     return 0;

 @@ -229,27 +229,27 @@ $code.=<<___;
 .Lsqr_1024_no_n_copy:
 	and		\$-1024, %rsp
 	vmovdqu		32*1-128($ap), $ACC1
 	vmovdqu		32*2-128($ap), $ACC2
 	vmovdqu		32*3-128($ap), $ACC3
 	vmovdqu		32*4-128($ap), $ACC4
 	vmovdqu		32*5-128($ap), $ACC5
 	vmovdqu		32*6-128($ap), $ACC6
 	vmovdqu		32*7-128($ap), $ACC7
 	vmovdqu		32*8-128($ap), $ACC8
 	lea	192(%rsp), $tp0			# 64+128=192
-	vpbroadcastq	.Land_mask(%rip), $AND_MASK
+	vmovdqu	.Land_mask(%rip), $AND_MASK
 	jmp	.LOOP_GRANDE_SQR_1024
 .align	32
 .LOOP_GRANDE_SQR_1024:
 	lea	32*18+128(%rsp), $aap		# size optimization
 	lea	448(%rsp), $tp1			# 64+128+256=448
 	# the squaring is performed as described in Variant B of
 	# "Speeding up Big-Number Squaring", so start by calculating
 	# the A*2=A+A vector
 	vpaddq		$ACC1, $ACC1, $ACC1
 	 vpbroadcastq	32*0-128($ap), $B1
 	vpaddq		$ACC2, $ACC2, $ACC2
 @@ -1060,43 +1060,45 @@ $code.=<<___;
 	 vmovq		$Bi, %rbx
 	vpaddq		$TEMP2,$ACC1,$ACC1
 	vpmuludq	32*2-128($np),$Yi,$TEMP0
 	vpaddq		$TEMP0,$ACC2,$ACC2
 	vpmuludq	32*3-128($np),$Yi,$TEMP1
 	vpaddq		$TEMP1,$ACC3,$ACC3
 	vpmuludq	32*4-128($np),$Yi,$TEMP2
 	vpaddq		$TEMP2,$ACC4,$ACC4
 	vpmuludq	32*5-128($np),$Yi,$TEMP0
 	vpaddq		$TEMP0,$ACC5,$ACC5
 	vpmuludq	32*6-128($np),$Yi,$TEMP1
 	vpaddq		$TEMP1,$ACC6,$ACC6
 	vpmuludq	32*7-128($np),$Yi,$TEMP2
-	 vpblendd	\$3, $ZERO, $ACC9, $ACC9	# correct $ACC3
+	 vpblendd	\$3, $ZERO, $ACC9, $TEMP1	# correct $ACC3
 	vpaddq		$TEMP2,$ACC7,$ACC7
 	vpmuludq	32*8-128($np),$Yi,$TEMP0
-	 vpaddq		$ACC9, $ACC3, $ACC3		# correct $ACC3
+	 vpaddq		$TEMP1, $ACC3, $ACC3		# correct $ACC3
 	vpaddq		$TEMP0,$ACC8,$ACC8
 	mov	%rbx, %rax
 	imulq	-128($ap),%rax
 	add	%rax,$r1
 	 vmovdqu	-8+32*1-128($ap),$TEMP1
 	mov	%rbx, %rax
 	imulq	8-128($ap),%rax
 	add	%rax,$r2
 	 vmovdqu	-8+32*2-128($ap),$TEMP2
 	mov	$r1, %rax
 	 vpblendd	\$0xfc, $ZERO, $ACC9, $ACC9	# correct $ACC3
 	imull	$n0, %eax
 	 vpaddq		$ACC9,$ACC4,$ACC4		# correct $ACC3
 	and	\$0x1fffffff, %eax
 	 imulq	16-128($ap),%rbx
 	 add	%rbx,$r3
 	vpmuludq	$Bi,$TEMP1,$TEMP1
 	 vmovd		%eax, $Yi
 	vmovdqu		-8+32*3-128($ap),$TEMP0
 	vpaddq		$TEMP1,$ACC1,$ACC1
 	vpmuludq	$Bi,$TEMP2,$TEMP2
 	 vpbroadcastq	$Yi, $Yi
 	vmovdqu		-8+32*4-128($ap),$TEMP1
 	vpaddq		$TEMP2,$ACC2,$ACC2
 	vpmuludq	$Bi,$TEMP0,$TEMP0
 @@ -1312,35 +1314,32 @@ $code.=<<___;
 	vpmuludq	$Yi,$TEMP2,$TEMP2
 	 vmovq	$r3, $TEMP1
 	vpaddq		$TEMP2,$ACC9,$ACC8
 	dec	$i
 	jnz	.Loop_mul_1024
 ___
 # (*)	Original implementation was correcting ACC1-ACC3 for overflow
 #	after 7 loop runs, or after 28 iterations, or 56 additions.
 #	But as we underutilize resources, it's possible to correct in
 #	each iteration with marginal performance loss. But then, as
 #	we do it in each iteration, we can correct less digits, and
-#	avoid performance penalties completely. Also note that we
+#	avoid performance penalties completely.
 #	correct only three digits out of four. This works because
 #	most significant digit is subjected to less additions.
 $TEMP0 = $ACC9;
 $TEMP3 = $Bi;
 $TEMP4 = $Yi;
 $code.=<<___;
 	vpermq		\$0, $AND_MASK, $AND_MASK
 	vpaddq		(%rsp), $TEMP1, $ACC0
 	vpsrlq		\$29, $ACC0, $TEMP1
 	vpand		$AND_MASK, $ACC0, $ACC0
 	vpsrlq		\$29, $ACC1, $TEMP2
 	vpand		$AND_MASK, $ACC1, $ACC1
 	vpsrlq		\$29, $ACC2, $TEMP3
 	vpermq		\$0x93, $TEMP1, $TEMP1
 	vpand		$AND_MASK, $ACC2, $ACC2
 	vpsrlq		\$29, $ACC3, $TEMP4
 	vpermq		\$0x93, $TEMP2, $TEMP2
 	vpand		$AND_MASK, $ACC3, $ACC3
 @@ -1753,27 +1752,27 @@ $code.=<<___	if ($addx);
 	mov	\$0,%edx
 	and	%eax,%ecx
 	cmp	\$`1<<8|1<<19`,%ecx	# check for BMI2+AD*X
 	cmove	%edx,%eax
 ___
 $code.=<<___;
 	and	\$`1<<5`,%eax
 	shr	\$5,%eax
 	ret
 .size	rsaz_avx2_eligible,.-rsaz_avx2_eligible
 .align	64
 .Land_mask:
-	.quad	0x1fffffff,0x1fffffff,0x1fffffff,-1
+	.quad	0x1fffffff,0x1fffffff,0x1fffffff,0x1fffffff
 .Lscatter_permd:
 	.long	0,2,4,6,7,7,7,7
 .Lgather_permd:
 	.long	0,7,1,7,2,7,3,7
 .Linc:
 	.long	0,0,0,0, 1,1,1,1
 	.long	2,2,2,2, 3,3,3,3
 	.long	4,4,4,4, 4,4,4,4
 .align	64
 ___
 if ($win64) {
 $rec="%rcx";

 @@ -3080,31 +3080,39 @@ $code.=<<___;
 	adc	4*8($tptr),%r12
 	adc	5*8($tptr),%r13
 	adc	6*8($tptr),%r14
 	adc	7*8($tptr),%r15
 	lea	8*8($tptr),$tptr
 	.byte	0x67
 	sbb	%rax,%rax		# mov %cf,%rax
 	xor	%ebx,%ebx		# cf=0, of=0
 	mov	%rax,16+8(%rsp)		# offload carry
 	jmp	.Lsqrx8x_loop
 .align	32
 .Lsqrx8x_break:
-	sub	16+8(%rsp),%r8		# consume last carry
+	xor	$zero,$zero
 	sub	16+8(%rsp),%rbx		# mov 16(%rsp),%cf
 	adcx	$zero,%r8
 	mov	24+8(%rsp),$carry	# initial $tptr, borrow $carry
 	adcx	$zero,%r9
 	mov	0*8($aptr),%rdx		# a[8], modulo-scheduled
-	xor	%ebp,%ebp		# xor	$zero,$zero
+	adc	\$0,%r10
 	mov	%r8,0*8($tptr)
 	adc	\$0,%r11
 	adc	\$0,%r12
 	adc	\$0,%r13
 	adc	\$0,%r14
 	adc	\$0,%r15
 	cmp	$carry,$tptr		# cf=0, of=0
 	je	.Lsqrx8x_outer_loop
 	mov	%r9,1*8($tptr)
 	 mov	1*8($carry),%r9
 	mov	%r10,2*8($tptr)
 	 mov	2*8($carry),%r10
 	mov	%r11,3*8($tptr)
 	 mov	3*8($carry),%r11
 	mov	%r12,4*8($tptr)
 	 mov	4*8($carry),%r12
 	mov	%r13,5*8($tptr)
 	 mov	5*8($carry),%r13

 @@ -136,26 +136,29 @@ static int rsa_builtin_keygen(RSA *rsa,
     if (!rsa->q && ((rsa->q = BN_new()) == NULL))
         goto err;
     if (!rsa->dmp1 && ((rsa->dmp1 = BN_new()) == NULL))
         goto err;
     if (!rsa->dmq1 && ((rsa->dmq1 = BN_new()) == NULL))
         goto err;
     if (!rsa->iqmp && ((rsa->iqmp = BN_new()) == NULL))
         goto err;
     if (BN_copy(rsa->e, e_value) == NULL)
         goto err;
     /* generate p and q */
     BN_set_flags(rsa->p, BN_FLG_CONSTTIME);
     BN_set_flags(rsa->q, BN_FLG_CONSTTIME);
     BN_set_flags(r2, BN_FLG_CONSTTIME);
     for (;;) {
         if (!BN_generate_prime_ex(rsa->p, bitsp, 0, NULL, NULL, cb))
             goto err;
         if (!BN_sub(r2, rsa->p, BN_value_one()))
             goto err;
         if (!BN_gcd(r1, r2, rsa->e, ctx))
             goto err;
         if (BN_is_one(r1))
             break;
         if (!BN_GENCB_call(cb, 2, n++))
             goto err;
+    }
     if (!BN_GENCB_call(cb, 3, 0))

 @@ -120,30 +120,32 @@ static int length_from_afi(const unsigne
         return 4;
     case IANA_AFI_IPV6:
         return 16;
     default:
         return 0;
+    }
+}
 /*
  * Extract the AFI from an IPAddressFamily.
  */
 unsigned int v3_addr_get_afi(const IPAddressFamily *f)
+{
-    return ((f != NULL &&
+    if (f == NULL
-             f->addressFamily != NULL && f->addressFamily->data != NULL)
+            || f->addressFamily == NULL
-            ? ((f->addressFamily->data[0] << 8) | (f->addressFamily->data[1]))
+            || f->addressFamily->data == NULL
-            : 0);
+            || f->addressFamily->length < 2)
         return 0;
     return (f->addressFamily->data[0] << 8) | f->addressFamily->data[1];
+}
 /*
  * Expand the bitstring form of an address into a raw byte array.
  * At the moment this is coded for simplicity, not speed.
  */
 static int addr_expand(unsigned char *addr,
                        const ASN1_BIT_STRING *bs,
                        const int length, const unsigned char fill)
+{
     if (bs->length < 0 || bs->length > length)
         return 0;
     if (bs->length > 0) {

 @@ -1717,27 +1717,27 @@ extern "C" {
  * indicate where we are up to in the SSL connection establishment. The
  * macros that follow are about the only things you should need to use and
  * even then, only when using non-blocking IO. It can also be useful to work
  * out where you were when the connection failed
  */
 # define SSL_ST_CONNECT                  0x1000
 # define SSL_ST_ACCEPT                   0x2000
 # define SSL_ST_MASK                     0x0FFF
 # define SSL_ST_INIT                     (SSL_ST_CONNECT|SSL_ST_ACCEPT)
 # define SSL_ST_BEFORE                   0x4000
 # define SSL_ST_OK                       0x03
 # define SSL_ST_RENEGOTIATE              (0x04|SSL_ST_INIT)
-# define SSL_ST_ERR                      0x05
+# define SSL_ST_ERR                      (0x05|SSL_ST_INIT)
 # define SSL_CB_LOOP                     0x01
 # define SSL_CB_EXIT                     0x02
 # define SSL_CB_READ                     0x04
 # define SSL_CB_WRITE                    0x08
 # define SSL_CB_ALERT                    0x4000/* used in callback */
 # define SSL_CB_READ_ALERT               (SSL_CB_ALERT|SSL_CB_READ)
 # define SSL_CB_WRITE_ALERT              (SSL_CB_ALERT|SSL_CB_WRITE)
 # define SSL_CB_ACCEPT_LOOP              (SSL_ST_ACCEPT|SSL_CB_LOOP)
 # define SSL_CB_ACCEPT_EXIT              (SSL_ST_ACCEPT|SSL_CB_EXIT)
 # define SSL_CB_CONNECT_LOOP             (SSL_ST_CONNECT|SSL_CB_LOOP)
 # define SSL_CB_CONNECT_EXIT             (SSL_ST_CONNECT|SSL_CB_EXIT)
 # define SSL_CB_HANDSHAKE_START          0x10

 @@ -57,27 +57,27 @@ rsaz_1024_sqr_avx2:
 .Lsqr_1024_no_n_copy:
 	andq	$-1024,%rsp
 	vmovdqu	32-128(%rsi),%ymm1
 	vmovdqu	64-128(%rsi),%ymm2
 	vmovdqu	96-128(%rsi),%ymm3
 	vmovdqu	128-128(%rsi),%ymm4
 	vmovdqu	160-128(%rsi),%ymm5
 	vmovdqu	192-128(%rsi),%ymm6
 	vmovdqu	224-128(%rsi),%ymm7
 	vmovdqu	256-128(%rsi),%ymm8
 	leaq	192(%rsp),%rbx
-	vpbroadcastq	.Land_mask(%rip),%ymm15
+	vmovdqu	.Land_mask(%rip),%ymm15
 	jmp	.LOOP_GRANDE_SQR_1024
 .align	32
 .LOOP_GRANDE_SQR_1024:
 	leaq	576+128(%rsp),%r9
 	leaq	448(%rsp),%r12
 	vpaddq	%ymm1,%ymm1,%ymm1
 	vpbroadcastq	0-128(%rsi),%ymm10
 	vpaddq	%ymm2,%ymm2,%ymm2
 @@ -790,43 +790,45 @@ rsaz_1024_mul_avx2:
 	vmovq	%xmm10,%rbx
 	vpaddq	%ymm13,%ymm1,%ymm1
 	vpmuludq	64-128(%rcx),%ymm11,%ymm0
 	vpaddq	%ymm0,%ymm2,%ymm2
 	vpmuludq	96-128(%rcx),%ymm11,%ymm12
 	vpaddq	%ymm12,%ymm3,%ymm3
 	vpmuludq	128-128(%rcx),%ymm11,%ymm13
 	vpaddq	%ymm13,%ymm4,%ymm4
 	vpmuludq	160-128(%rcx),%ymm11,%ymm0
 	vpaddq	%ymm0,%ymm5,%ymm5
 	vpmuludq	192-128(%rcx),%ymm11,%ymm12
 	vpaddq	%ymm12,%ymm6,%ymm6
 	vpmuludq	224-128(%rcx),%ymm11,%ymm13
-	vpblendd	$3,%ymm14,%ymm9,%ymm9
+	vpblendd	$3,%ymm14,%ymm9,%ymm12
 	vpaddq	%ymm13,%ymm7,%ymm7
 	vpmuludq	256-128(%rcx),%ymm11,%ymm0
-	vpaddq	%ymm9,%ymm3,%ymm3
+	vpaddq	%ymm12,%ymm3,%ymm3
 	vpaddq	%ymm0,%ymm8,%ymm8
 	movq	%rbx,%rax
 	imulq	-128(%rsi),%rax
 	addq	%rax,%r10
 	vmovdqu	-8+32-128(%rsi),%ymm12
 	movq	%rbx,%rax
 	imulq	8-128(%rsi),%rax
 	addq	%rax,%r11
 	vmovdqu	-8+64-128(%rsi),%ymm13
 	movq	%r10,%rax
 	vpblendd	$0xfc,%ymm14,%ymm9,%ymm9
 	imull	%r8d,%eax
 	vpaddq	%ymm9,%ymm4,%ymm4
 	andl	$0x1fffffff,%eax
 	imulq	16-128(%rsi),%rbx
 	addq	%rbx,%r12
 	vpmuludq	%ymm10,%ymm12,%ymm12
 	vmovd	%eax,%xmm11
 	vmovdqu	-8+96-128(%rsi),%ymm0
 	vpaddq	%ymm12,%ymm1,%ymm1
 	vpmuludq	%ymm10,%ymm13,%ymm13
 	vpbroadcastq	%xmm11,%ymm11
 	vmovdqu	-8+128-128(%rsi),%ymm12
 	vpaddq	%ymm13,%ymm2,%ymm2
 	vpmuludq	%ymm10,%ymm0,%ymm0
 @@ -1035,27 +1037,26 @@ rsaz_1024_mul_avx2:
 	vpmuludq	%ymm11,%ymm0,%ymm0
 	vmovdqu	-24+288-128(%rcx),%ymm13
 	movq	%r12,%r9
 	vpaddq	%ymm0,%ymm7,%ymm6
 	vpmuludq	%ymm11,%ymm12,%ymm12
 	addq	(%rsp),%r9
 	vpaddq	%ymm12,%ymm8,%ymm7
 	vpmuludq	%ymm11,%ymm13,%ymm13
 	vmovq	%r12,%xmm12
 	vpaddq	%ymm13,%ymm9,%ymm8
 	decl	%r14d
 	jnz	.Loop_mul_1024
 	vpermq	$0,%ymm15,%ymm15
 	vpaddq	(%rsp),%ymm12,%ymm0
 	vpsrlq	$29,%ymm0,%ymm12
 	vpand	%ymm15,%ymm0,%ymm0
 	vpsrlq	$29,%ymm1,%ymm13
 	vpand	%ymm15,%ymm1,%ymm1
 	vpsrlq	$29,%ymm2,%ymm10
 	vpermq	$0x93,%ymm12,%ymm12
 	vpand	%ymm15,%ymm2,%ymm2
 	vpsrlq	$29,%ymm3,%ymm11
 	vpermq	$0x93,%ymm13,%ymm13
 	vpand	%ymm15,%ymm3,%ymm3
 @@ -1675,23 +1676,23 @@ rsaz_avx2_eligible:
 	movl	OPENSSL_ia32cap_P+8(%rip),%eax
 	movl	$524544,%ecx
 	movl	$0,%edx
 	andl	%eax,%ecx
 	cmpl	$524544,%ecx
 	cmovel	%edx,%eax
 	andl	$32,%eax
 	shrl	$5,%eax
 	.byte	0xf3,0xc3
 .size	rsaz_avx2_eligible,.-rsaz_avx2_eligible
 .align	64
 .Land_mask:
-.quad	0x1fffffff,0x1fffffff,0x1fffffff,-1
+.quad	0x1fffffff,0x1fffffff,0x1fffffff,0x1fffffff
 .Lscatter_permd:
 .long	0,2,4,6,7,7,7,7
 .Lgather_permd:
 .long	0,7,1,7,2,7,3,7
 .Linc:
 .long	0,0,0,0, 1,1,1,1
 .long	2,2,2,2, 3,3,3,3
 .long	4,4,4,4, 4,4,4,4
 .align	64

 @@ -3066,31 +3066,39 @@ __bn_sqrx8x_internal:
 	adcq	32(%rdi),%r12
 	adcq	40(%rdi),%r13
 	adcq	48(%rdi),%r14
 	adcq	56(%rdi),%r15
 	leaq	64(%rdi),%rdi
 .byte	0x67
 	sbbq	%rax,%rax
 	xorl	%ebx,%ebx
 	movq	%rax,16+8(%rsp)
 	jmp	.Lsqrx8x_loop
 .align	32
 .Lsqrx8x_break:
-	subq	16+8(%rsp),%r8
+	xorq	%rbp,%rbp
 	subq	16+8(%rsp),%rbx
 	adcxq	%rbp,%r8
 	movq	24+8(%rsp),%rcx
 	adcxq	%rbp,%r9
 	movq	0(%rsi),%rdx
-	xorl	%ebp,%ebp
+	adcq	$0,%r10
 	movq	%r8,0(%rdi)
 	adcq	$0,%r11
 	adcq	$0,%r12
 	adcq	$0,%r13
 	adcq	$0,%r14
 	adcq	$0,%r15
 	cmpq	%rcx,%rdi
 	je	.Lsqrx8x_outer_loop
 	movq	%r9,8(%rdi)
 	movq	8(%rcx),%r9
 	movq	%r10,16(%rdi)
 	movq	16(%rcx),%r10
 	movq	%r11,24(%rdi)
 	movq	24(%rcx),%r11
 	movq	%r12,32(%rdi)
 	movq	32(%rcx),%r12
 	movq	%r13,40(%rdi)
 	movq	40(%rcx),%r13