imported changes from mozilla NSS:

- Bug 1759794 - protect SFTKSlot needLogin with slotLock. r=rrelyea (1bbd8d8c)
- Bug 1771497 - Uninitialized value in cert_VerifyCertChainOld. r=nss-reviewers,djackson (23be110c)
- Bug 1771495 - unchecked return code in sec_DecodeSigAlg. r=nss-reviewers,djackson (d4fb4b83)
- Bug 1771498 - Uninitialized value in cert_ComputeCertType. r=djackson (b28bc4cd)
- Bug 1764392 - Add DigitCert Roots r=nss-reviewers,jschanck (0863d9ec)
- Bug 1768970 - Add Certainly Roots. r=nss-reviewers,jschanck (6307e75b)
- Bug 1770267 - Add E-Tugra Roots. r=nss-reviewers,jschanck (9555008f)
- Bug 1759815 - Remove Hellenic Academic 2011 Root. r=nss-reviewers,jschanck (9c2cbf14)
- Bug 1764206 - Bump nssckbi version number for June. r=nss-reviewers,jschanck (b3acf3d9)

security/nss/lib/cryptohi/secvfy.c

@@ -296,8 +296,8 @@ sec_DecodeSigAlg(const SECKEYPublicKey *key, SECOidTag sigAlg,
                 PORT_DestroyCheapArena(&tmpArena);
 
                 /* only accept hash algorithms */
-                if (HASH_GetHashTypeByOidTag(*hashalg) == HASH_AlgNULL) {
-                    /* error set by HASH_GetHashTypeByOidTag */
+                if (rv != SECSuccess || HASH_GetHashTypeByOidTag(*hashalg) == HASH_AlgNULL) {
+                    /* error set by sec_DecodeRSAPSSParams or HASH_GetHashTypeByOidTag */
                     return SECFailure;
                 }
             } else {