wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-10-22 07:07:30 +09:00
Code Issues Projects Releases Packages Wiki Activity

Issue #1338 - Followup: certdb: propagate trust information if trust

Browse source 
module is loaded afterwards,

Summary: When the builtin trust module is loaded after some temp certs
being created, these temp certs are usually not accompanied by trust
information. This causes a problem in UXP as it loads the module from a
separate thread while accessing the network cache which populates temp
certs.

This change makes it properly roll up the trust information, if a temp
cert doesn't have trust information.
This commit is contained in:
Daiki Ueno 2020-01-10 20:34:53 +01:00 • committed by Roy Tam
commit 75fdf9c3b0
1 changed files with 22 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

30
security/nss/lib/pki/pki3hack.c
View file

@ -921,14 +921,28 @@ stan_GetCERTCertificate(NSSCertificate *c, PRBool forceUpdate)
} }
if (!cc->nssCertificate || forceUpdate) { if (!cc->nssCertificate || forceUpdate) {
fill_CERTCertificateFields(c, cc, forceUpdate); fill_CERTCertificateFields(c, cc, forceUpdate);
} else if (CERT_GetCertTrust(cc, &certTrust) != SECSuccess && } else if (CERT_GetCertTrust(cc, &certTrust) != SECSuccess) {
!c->object.cryptoContext) { CERTCertTrust *trust;
/* if it's a perm cert, it might have been stored before the if (!c->object.cryptoContext) {
* trust, so look for the trust again. But a temp cert can be /* If it's a perm cert, it might have been stored before the
* ignored. * trust, so look for the trust again.
*/ */
CERTCertTrust *trust = NULL; trust = nssTrust_GetCERTCertTrustForCert(c, cc);
trust = nssTrust_GetCERTCertTrustForCert(c, cc); } else {
/* If it's a temp cert, it might have been stored before the
* builtin trust module is loaded, so look for the trust
* again, but don't set the empty trust if it is not found.
*/
NSSTrust *t = nssTrustDomain_FindTrustForCertificate(c->object.cryptoContext->td, c);
if (!t) {
goto loser;
}
trust = cert_trust_from_stan_trust(t, cc->arena);
nssTrust_Destroy(t);
if (!trust) {
goto loser;
}
}
CERT_LockCertTrust(cc); CERT_LockCertTrust(cc);
cc->trust = trust; cc->trust = trust;