Update NSS to 3.48 while keeping vc2013 hackfix and no-sslkeylogfile intact.

security/nss/lib/util/nssutil.h

@@ -19,10 +19,10 @@
  * The format of the version string should be
  *     "<major version>.<minor version>[.<patch level>[.<build number>]][ <Beta>]"
  */
-#define NSSUTIL_VERSION "3.44.3"
+#define NSSUTIL_VERSION "3.48"
 #define NSSUTIL_VMAJOR 3
-#define NSSUTIL_VMINOR 44
-#define NSSUTIL_VPATCH 3
+#define NSSUTIL_VMINOR 48
+#define NSSUTIL_VPATCH 0
 #define NSSUTIL_VBUILD 0
 #define NSSUTIL_BETA PR_FALSE
 

security/nss/lib/util/pkcs11n.h

@@ -94,6 +94,8 @@
 #define CKA_NSS_JPAKE_X2S (CKA_NSS + 33)
 
 #define CKA_NSS_MOZILLA_CA_POLICY (CKA_NSS + 34)
+#define CKA_NSS_SERVER_DISTRUST_AFTER (CKA_NSS + 35)
+#define CKA_NSS_EMAIL_DISTRUST_AFTER (CKA_NSS + 36)
 
 /*
  * Trust attributes:

security/nss/lib/util/pkcs11t.h

@@ -313,6 +313,7 @@ typedef CK_ULONG CK_OBJECT_CLASS;
 /* CKO_HW_FEATURE is new for v2.10 */
 /* CKO_DOMAIN_PARAMETERS is new for v2.11 */
 /* CKO_MECHANISM is new for v2.20 */
+/* CKO_PROFILE is new for v3.00 */
 #define CKO_DATA 0x00000000
 #define CKO_CERTIFICATE 0x00000001
 #define CKO_PUBLIC_KEY 0x00000002
@@ -321,10 +322,23 @@ typedef CK_ULONG CK_OBJECT_CLASS;
 #define CKO_HW_FEATURE 0x00000005
 #define CKO_DOMAIN_PARAMETERS 0x00000006
 #define CKO_MECHANISM 0x00000007
+#define CKO_PROFILE 0x00000009
 #define CKO_VENDOR_DEFINED 0x80000000
 
 typedef CK_OBJECT_CLASS CK_PTR CK_OBJECT_CLASS_PTR;
 
+/* CK_PROFILE_ID is new for v3.00. CK_PROFILE_ID is a value that
+ * identifies the profile that the token supports. */
+typedef CK_ULONG CK_PROFILE_ID;
+
+/* Profile ID's */
+#define CKP_INVALID_ID 0x00000000UL
+#define CKP_BASELINE_PROVIDER 0x00000001UL
+#define CKP_EXTENDED_PROVIDER 0x00000002UL
+#define CKP_AUTHENTICATION_TOKEN 0x00000003UL
+#define CKP_PUBLIC_CERTIFICATES_TOKEN 0x00000004UL
+#define CKP_VENDOR_DEFINED 0x80000000UL
+
 /* CK_HW_FEATURE_TYPE is new for v2.10. CK_HW_FEATURE_TYPE is a
  * value that identifies the hardware feature type of an object
  * with CK_OBJECT_CLASS equal to CKO_HW_FEATURE. */
@@ -536,6 +550,7 @@ typedef CK_ULONG CK_ATTRIBUTE_TYPE;
 #define CKA_DEFAULT_CMS_ATTRIBUTES 0x00000502
 #define CKA_SUPPORTED_CMS_ATTRIBUTES 0x00000503
 #define CKA_ALLOWED_MECHANISMS (CKF_ARRAY_ATTRIBUTE | 0x00000600)
+#define CKA_PROFILE_ID 0x00000601UL
 
 #define CKA_VENDOR_DEFINED 0x80000000
 
@@ -882,6 +897,9 @@ typedef CK_ULONG CK_MECHANISM_TYPE;
 #define CKM_AES_GCM 0x00001087
 #define CKM_AES_CCM 0x00001088
 #define CKM_AES_CTS 0x00001089
+/* AES-CMAC values copied from v2.40 errata 1 header file */
+#define CKM_AES_CMAC_GENERAL 0x0000108A
+#define CKM_AES_CMAC 0x0000108B
 #define CKM_AES_XCBC_MAC 0x0000108C
 #define CKM_AES_XCBC_MAC_96 0x0000108D
 

security/nss/lib/util/quickder.c

@@ -758,7 +758,7 @@ DecodeItem(void* dest,
 
                         case SEC_ASN1_BIT_STRING: {
                             /* Can't be 8 or more spare bits, or any spare bits
-			     * if there are no octets. */
+                             * if there are no octets. */
                             if (temp.data[0] >= 8 || (temp.data[0] > 0 && temp.len == 1)) {
                                 PORT_SetError(SEC_ERROR_BAD_DER);
                                 rv = SECFailure;

security/nss/lib/util/secport.h

@@ -121,6 +121,11 @@ extern char *PORT_ArenaStrdup(PLArenaPool *arena, const char *str);
 SEC_END_PROTOS
 
 #define PORT_Assert PR_ASSERT
+/* This is a variation of PORT_Assert where the arguments will be always
+ * used either in Debug or not. But, in optimized mode the result will be
+ * ignored. See more details in Bug 1588015. */
+#define PORT_AssertArg PR_ASSERT_ARG
+
 /* This runs a function that should return SECSuccess.
  * Intended for NSS internal use only.
  * The return value is asserted in a debug build, otherwise it is ignored.

security/nss/lib/util/utilmod.c

@@ -413,7 +413,10 @@ nssutil_ReadSecmodDB(const char *appName,
 
         /* remove the ending newline */
         len = PORT_Strlen(line);
-        if (len && line[len - 1] == '\n') {
+        if (len >= 2 && line[len - 2] == '\r' && line[len - 1] == '\n') {
+            len = len - 2;
+            line[len] = 0;
+        } else if (len && (line[len - 1] == '\n' || line[len - 1] == '\r')) {
             len--;
             line[len] = 0;
         }