Replace NSS with Pale Moon's

security/nss/lib/pki/Makefile

@@ -4,8 +4,11 @@
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 include manifest.mn
-include $(CORE_DEPTH)/coreconf/config.mk
-include config.mk
-include $(CORE_DEPTH)/coreconf/rules.mk
 
-export:: private_export
+include $(CORE_DEPTH)/coreconf/config.mk
+
+ifdef BUILD_IDG
+DEFINES += -DNSSDEBUG
+endif
+
+include $(CORE_DEPTH)/coreconf/rules.mk

security/nss/lib/pki/asymmkey.c

@@ -166,7 +166,7 @@ NSS_IMPLEMENT NSSPublicKey *
 NSSPrivateKey_FindPublicKey(
     NSSPrivateKey *vk
     /* { don't need the callback here, right? } */
-    )
+)
 {
     nss_SetError(NSS_ERROR_NOT_FOUND);
     return NULL;

security/nss/lib/pki/certificate.c

@@ -210,22 +210,22 @@ NSSCertificate_Validate(
     NSSTime *timeOpt, /* NULL for "now" */
     NSSUsage *usage,
     NSSPolicies *policiesOpt /* NULL for none */
-    )
+)
 {
     nss_SetError(NSS_ERROR_NOT_FOUND);
     return PR_FAILURE;
 }
 
 NSS_IMPLEMENT void ** /* void *[] */
-    NSSCertificate_ValidateCompletely(
-        NSSCertificate *c,
-        NSSTime *timeOpt, /* NULL for "now" */
-        NSSUsage *usage,
-        NSSPolicies *policiesOpt, /* NULL for none */
-        void **rvOpt,             /* NULL for allocate */
-        PRUint32 rvLimit,         /* zero for no limit */
-        NSSArena *arenaOpt        /* NULL for heap */
-        )
+NSSCertificate_ValidateCompletely(
+    NSSCertificate *c,
+    NSSTime *timeOpt, /* NULL for "now" */
+    NSSUsage *usage,
+    NSSPolicies *policiesOpt, /* NULL for none */
+    void **rvOpt,             /* NULL for allocate */
+    PRUint32 rvLimit,         /* zero for no limit */
+    NSSArena *arenaOpt        /* NULL for heap */
+)
 {
     nss_SetError(NSS_ERROR_NOT_FOUND);
     return NULL;

security/nss/lib/pki/config.mk

@@ -1,19 +0,0 @@
-# 
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-ifdef BUILD_IDG
-DEFINES += -DNSSDEBUG
-endif
-
-#
-#  Override TARGETS variable so that only static libraries
-#  are specifed as dependencies within rules.mk.
-#
-
-TARGETS        = $(LIBRARY)
-SHARED_LIBRARY =
-IMPORT_LIBRARY =
-PROGRAM        =
-

security/nss/lib/pki/cryptocontext.c

@@ -188,7 +188,7 @@ NSSCryptoContext_FindBestCertificateByNickname(
     NSSTime *timeOpt, /* NULL for "now" */
     NSSUsage *usage,
     NSSPolicies *policiesOpt /* NULL for none */
-    )
+)
 {
     NSSCertificate **certs;
     NSSCertificate *rvCert = NULL;

security/nss/lib/pki/manifest.mn

@@ -16,9 +16,6 @@ PRIVATE_EXPORTS = \
 	pkim.h     \
 	$(NULL)
 
-EXPORTS =	   \
-	$(NULL)
-
 MODULE = nss
 
 CSRCS =		        \
@@ -39,7 +36,7 @@ CSRCS =		        \
 REQUIRES = nspr
 
 LIBRARY_NAME = nsspki
-LIBRARY_VERSION = 3
+SHARED_LIBRARY = $(NULL)
 
 # This part of the code, including all sub-dirs, can be optimized for size
 export ALLOW_OPT_CODE_SIZE = 1

security/nss/lib/pki/nsspki.h

@@ -115,7 +115,7 @@ NSSCertificate_Validate(
     NSSTime *timeOpt, /* NULL for "now" */
     NSSUsage *usage,
     NSSPolicies *policiesOpt /* NULL for none */
-    );
+);
 
 /*
  * NSSCertificate_ValidateCompletely
@@ -135,15 +135,15 @@ NSSCertificate_Validate(
  */
 
 NSS_EXTERN void ** /* void *[] */
-    NSSCertificate_ValidateCompletely(
-        NSSCertificate *c,
-        NSSTime *timeOpt, /* NULL for "now" */
-        NSSUsage *usage,
-        NSSPolicies *policiesOpt, /* NULL for none */
-        void **rvOpt,             /* NULL for allocate */
-        PRUint32 rvLimit,         /* zero for no limit */
-        NSSArena *arenaOpt        /* NULL for heap */
-        );
+NSSCertificate_ValidateCompletely(
+    NSSCertificate *c,
+    NSSTime *timeOpt, /* NULL for "now" */
+    NSSUsage *usage,
+    NSSPolicies *policiesOpt, /* NULL for none */
+    void **rvOpt,             /* NULL for allocate */
+    PRUint32 rvLimit,         /* zero for no limit */
+    NSSArena *arenaOpt        /* NULL for heap */
+);
 
 /*
  * NSSCertificate_ValidateAndDiscoverUsagesAndPolicies
@@ -675,7 +675,7 @@ NSS_EXTERN NSSPublicKey *
 NSSPrivateKey_FindPublicKey(
     NSSPrivateKey *vk
     /* { don't need the callback here, right? } */
-    );
+);
 
 /*
  * NSSPrivateKey_CreateCryptoContext
@@ -1363,7 +1363,7 @@ NSSTrustDomain_FindBestTokenForAlgorithms(
     NSSTrustDomain *td,
     NSSOID *algorithms[],   /* may be null-terminated */
     PRUint32 nAlgorithmsOpt /* limits the array if nonzero */
-    );
+);
 
 /*
  * NSSTrustDomain_Login
@@ -1470,7 +1470,7 @@ NSSTrustDomain_FindBestCertificateByNickname(
     NSSTime *timeOpt, /* NULL for "now" */
     NSSUsage *usage,
     NSSPolicies *policiesOpt /* NULL for none */
-    );
+);
 
 /*
  * NSSTrustDomain_FindCertificatesByNickname
@@ -2001,7 +2001,7 @@ NSSCryptoContext_FindBestCertificateByNickname(
     NSSTime *timeOpt, /* NULL for "now" */
     NSSUsage *usage,
     NSSPolicies *policiesOpt /* NULL for none */
-    );
+);
 
 /*
  * NSSCryptoContext_FindCertificatesByNickname

security/nss/lib/pki/pki3hack.c

@@ -190,16 +190,17 @@ STAN_RemoveModuleFromDefaultTrustDomain(
             nssToken_NotifyCertsNotVisible(token);
             NSSRWLock_LockWrite(td->tokensLock);
             nssList_Remove(td->tokenList, token);
+            /* Rebuild the td->tokens iterator clone while still holding the
+             * write lock, so that concurrent readers cannot observe the token
+             * through a stale iterator after we drop the lock and free it. */
+            nssListIterator_Destroy(td->tokens);
+            td->tokens = nssList_CreateIterator(td->tokenList);
             NSSRWLock_UnlockWrite(td->tokensLock);
             PK11Slot_SetNSSToken(module->slots[i], NULL);
             (void)nssToken_Destroy(token); /* for the |td->tokenList| reference */
             (void)nssToken_Destroy(token); /* for our PK11Slot_GetNSSToken reference */
         }
     }
-    NSSRWLock_LockWrite(td->tokensLock);
-    nssListIterator_Destroy(td->tokens);
-    td->tokens = nssList_CreateIterator(td->tokenList);
-    NSSRWLock_UnlockWrite(td->tokensLock);
     return SECSuccess;
 }
 

security/nss/lib/pki/pki3hack.h

@@ -103,7 +103,7 @@ nssTrustDomain_FindBestCertificateByNicknameForToken(
     NSSTime *timeOpt, /* NULL for "now" */
     NSSUsage *usage,
     NSSPolicies *policiesOpt /* NULL for none */
-    );
+);
 
 /* This function is being put here because it is a hack for
  * PK11_FindCertsFromNickname.

security/nss/lib/pki/tdcache.c

@@ -41,13 +41,13 @@ log_item_dump(const char *msg, NSSItem *it)
     char buf[33];
     int i, j;
     for (i = 0; i < 10 && i < it->size; i++) {
-        sprintf(&buf[2 * i], "%02X", ((PRUint8 *)it->data)[i]);
+        snprintf(&buf[2 * i], sizeof(buf) - 2 * i, "%02X", ((PRUint8 *)it->data)[i]);
     }
     if (it->size > 10) {
-        sprintf(&buf[2 * i], "..");
+        snprintf(&buf[2 * i], sizeof(buf) - 2 * i, "..");
         i += 1;
         for (j = it->size - 1; i <= 16 && j > 10; i++, j--) {
-            sprintf(&buf[2 * i], "%02X", ((PRUint8 *)it->data)[j]);
+            snprintf(&buf[2 * i], sizeof(buf) - 2 * i, "%02X", ((PRUint8 *)it->data)[j]);
         }
     }
     PR_LOG(s_log, PR_LOG_DEBUG, ("%s: %s", msg, buf));
@@ -58,8 +58,7 @@ log_item_dump(const char *msg, NSSItem *it)
 static void
 log_cert_ref(const char *msg, NSSCertificate *c)
 {
-    PR_LOG(s_log, PR_LOG_DEBUG, ("%s: %s", msg,
-                                 (c->nickname) ? c->nickname : c->email));
+    PR_LOG(s_log, PR_LOG_DEBUG, ("%s: %s", msg, (c->nickname) ? c->nickname : c->email));
     log_item_dump("\tserial", &c->serial);
     log_item_dump("\tsubject", &c->subject);
 }
@@ -74,7 +73,7 @@ log_cert_ref(const char *msg, NSSCertificate *c)
 
 /* should it live in its own arena? */
 struct nssTDCertificateCacheStr {
-    PZLock *lock;
+    PZLock *lock; /* Must not be held when calling nssSlot_IsTokenPresent. See bug 1625791. */
     NSSArena *arena;
     nssHash *issuerAndSN;
     nssHash *subject;
@@ -92,6 +91,7 @@ struct cache_entry_str {
     PRTime lastHit;
     NSSArena *arena;
     NSSUTF8 *nickname;
+    NSSASCII7 *email;
 };
 
 typedef struct cache_entry_str cache_entry;
@@ -230,6 +230,7 @@ remove_subject_entry(
     NSSCertificate *cert,
     nssList **subjectList,
     NSSUTF8 **nickname,
+    NSSASCII7 **email,
     NSSArena **arena)
 {
     PRStatus nssrv;
@@ -243,6 +244,7 @@ remove_subject_entry(
         nssList_Remove(ce->entry.list, cert);
         *subjectList = ce->entry.list;
         *nickname = ce->nickname;
+        *email = ce->email;
         *arena = ce->arena;
         nssrv = PR_SUCCESS;
 #ifdef DEBUG_CACHE
@@ -277,35 +279,34 @@ remove_nickname_entry(
 static PRStatus
 remove_email_entry(
     nssTDCertificateCache *cache,
-    NSSCertificate *cert,
+    NSSASCII7 *email,
     nssList *subjectList)
 {
     PRStatus nssrv = PR_FAILURE;
     cache_entry *ce;
-    /* Find the subject list in the email hash */
-    if (cert->email) {
-        ce = (cache_entry *)nssHash_Lookup(cache->email, cert->email);
+    if (email) {
+        ce = (cache_entry *)nssHash_Lookup(cache->email, email);
         if (ce) {
             nssList *subjects = ce->entry.list;
             /* Remove the subject list from the email hash */
             if (subjects) {
                 nssList_Remove(subjects, subjectList);
 #ifdef DEBUG_CACHE
-                log_item_dump("removed subject list", &cert->subject);
-                PR_LOG(s_log, PR_LOG_DEBUG, ("for email %s", cert->email));
+                PR_LOG(s_log, PR_LOG_DEBUG,
+                       ("removed subject list for email %s", email));
 #endif
                 if (nssList_Count(subjects) == 0) {
                     /* No more subject lists for email, delete list and
                      * remove hash entry
                      */
                     (void)nssList_Destroy(subjects);
-                    nssHash_Remove(cache->email, cert->email);
+                    nssHash_Remove(cache->email, email);
                     /* there are no entries left for this address, free space
                      * used for email entries
                      */
                     nssArena_Destroy(ce->arena);
 #ifdef DEBUG_CACHE
-                    PR_LOG(s_log, PR_LOG_DEBUG, ("removed email %s", cert->email));
+                    PR_LOG(s_log, PR_LOG_DEBUG, ("removed email %s", email));
 #endif
                 }
             }
@@ -324,6 +325,7 @@ nssTrustDomain_RemoveCertFromCacheLOCKED(
     cache_entry *ce;
     NSSArena *arena;
     NSSUTF8 *nickname = NULL;
+    NSSASCII7 *email = NULL;
 
 #ifdef DEBUG_CACHE
     log_cert_ref("attempt to remove cert", cert);
@@ -340,10 +342,10 @@ nssTrustDomain_RemoveCertFromCacheLOCKED(
     }
     (void)remove_issuer_and_serial_entry(td->cache, cert);
     (void)remove_subject_entry(td->cache, cert, &subjectList,
-                               &nickname, &arena);
+                               &nickname, &email, &arena);
     if (nssList_Count(subjectList) == 0) {
         (void)remove_nickname_entry(td->cache, nickname, subjectList);
-        (void)remove_email_entry(td->cache, cert, subjectList);
+        (void)remove_email_entry(td->cache, email, subjectList);
         (void)nssList_Destroy(subjectList);
         nssHash_Remove(td->cache->subject, &cert->subject);
         /* there are no entries left for this subject, free the space used
@@ -538,6 +540,9 @@ add_subject_entry(
         if (nickname) {
             ce->nickname = nssUTF8_Duplicate(nickname, arena);
         }
+        if (cert->email) {
+            ce->email = nssUTF8_Duplicate(cert->email, arena);
+        }
         nssList_SetSortFunction(list, nssCertificate_SubjectListSort);
         /* Add the cert entry to this list of subjects */
         nssrv = nssList_AddUnique(list, cert);
@@ -711,8 +716,17 @@ add_cert_to_cache(
     PRUint32 added = 0;
     cache_entry *ce;
     NSSCertificate *rvCert = NULL;
+    NSSASCII7 *email = NULL;
     NSSUTF8 *certNickname = nssCertificate_GetNickname(cert, NULL);
 
+    /* Set cc->trust and cc->nssCertificate before taking td->cache->lock.
+     * Otherwise, the sorter in add_subject_entry may eventually call
+     * nssSlot_IsTokenPresent, which must not occur while the cache lock
+     * is held. See bugs 1625791 and 1651564 for details. */
+    if (cert->type == NSSCertificateType_PKIX) {
+        (void)STAN_GetCERTCertificate(cert);
+    }
+
     PZ_Lock(td->cache->lock);
     /* If it exists in the issuer/serial hash, it's already in all */
     ce = (cache_entry *)nssHash_Lookup(td->cache->issuerAndSN, cert);
@@ -810,13 +824,13 @@ loser:
     }
     if (added >= 2) {
         (void)remove_subject_entry(td->cache, cert, &subjectList,
-                                   &certNickname, &arena);
+                                   &certNickname, &email, &arena);
     }
     if (added == 3 || added == 5) {
         (void)remove_nickname_entry(td->cache, certNickname, subjectList);
     }
     if (added >= 4) {
-        (void)remove_email_entry(td->cache, cert, subjectList);
+        (void)remove_email_entry(td->cache, email, subjectList);
     }
     if (subjectList) {
         nssHash_Remove(td->cache->subject, &cert->subject);

security/nss/lib/pki/trustdomain.c

@@ -62,14 +62,15 @@ static void
 token_destructor(void *t)
 {
     NSSToken *tok = (NSSToken *)t;
-    /* Remove the token list's reference to the token */
-    (void)nssToken_Destroy(tok);
 
     /* Signal that the slot should not give out any more references to the
-     * token. The token might still have a positive refcount after this call.
-     * The token has a reference to the slot, so the slot will not be destroyed
-     * until after the token's refcount drops to 0. */
+     * token. Do this first, while |tok| (and its reference to the slot) is
+     * still alive: the list may hold the last reference, in which case
+     * nssToken_Destroy() below frees the arena that contains |tok|. */
     PK11Slot_SetNSSToken(tok->pk11slot, NULL);
+
+    /* Remove the token list's reference to the token */
+    (void)nssToken_Destroy(tok);
 }
 
 NSS_IMPLEMENT PRStatus
@@ -253,10 +254,11 @@ NSSTrustDomain_FindTokensByURI(
     count = nssList_Count(td->tokenList);
     tokens = nss_ZNEWARRAY(NULL, NSSToken *, count + 1);
     if (!tokens) {
+        NSSRWLock_UnlockRead(td->tokensLock);
         return NULL;
     }
     for (tok = (NSSToken *)nssListIterator_Start(td->tokens);
-         tok != (NSSToken *)NULL;
+         tok != (NSSToken *)NULL && i < count;
          tok = (NSSToken *)nssListIterator_Next(td->tokens)) {
         if (nssToken_IsPresent(tok)) {
             slotinfo = tok->pk11slot;
@@ -318,7 +320,7 @@ NSSTrustDomain_FindBestTokenForAlgorithms(
     NSSTrustDomain *td,
     NSSOID *algorithms[],   /* may be null-terminated */
     PRUint32 nAlgorithmsOpt /* limits the array if nonzero */
-    )
+)
 {
     nss_SetError(NSS_ERROR_NOT_FOUND);
     return NULL;