From eb4044be798b7c7940323d91c6022b896267f792 Mon Sep 17 00:00:00 2001 From: Roy Tam Date: Fri, 22 Nov 2019 11:14:22 +0800 Subject: [PATCH] updated to nss-3.44.3 --- .../pkixder_universal_types_tests.cpp | 50 +++++++++++++++++++ .../nss/lib/mozpkix/include/pkix/pkixder.h | 11 ++++ security/nss/lib/mozpkix/lib/pkixcert.cpp | 19 +++---- security/nss/lib/nss/nss.h | 4 +- security/nss/lib/softoken/pkcs11c.c | 2 +- security/nss/lib/softoken/softkver.h | 4 +- security/nss/lib/util/nssutil.h | 4 +- 7 files changed, 75 insertions(+), 19 deletions(-) diff --git a/security/nss/gtests/mozpkix_gtest/pkixder_universal_types_tests.cpp b/security/nss/gtests/mozpkix_gtest/pkixder_universal_types_tests.cpp index 260c735ece..0dc8555d99 100644 --- a/security/nss/gtests/mozpkix_gtest/pkixder_universal_types_tests.cpp +++ b/security/nss/gtests/mozpkix_gtest/pkixder_universal_types_tests.cpp @@ -1224,3 +1224,53 @@ TEST_F(pkixder_universal_types_tests, OID) ASSERT_EQ(Success, OID(reader, expectedOID)); } + +TEST_F(pkixder_universal_types_tests, SkipOptionalImplicitPrimitiveTag) +{ + const uint8_t DER_IMPLICIT_BIT_STRING_WITH_CLASS_NUMBER_1[] = { + 0x81, + 0x04, + 0x00, + 0x0A, + 0x0B, + 0x0C, + }; + Input input(DER_IMPLICIT_BIT_STRING_WITH_CLASS_NUMBER_1); + Reader reader(input); + + ASSERT_EQ(Success, SkipOptionalImplicitPrimitiveTag(reader, 1)); + ASSERT_TRUE(reader.AtEnd()); +} + +TEST_F(pkixder_universal_types_tests, SkipOptionalImplicitPrimitiveTagMismatch) +{ + const uint8_t DER_IMPLICIT_BIT_STRING_WITH_CLASS_NUMBER_1[] = { + 0x81, + 0x04, + 0x00, + 0x0A, + 0x0B, + 0x0C, + }; + Input input(DER_IMPLICIT_BIT_STRING_WITH_CLASS_NUMBER_1); + Reader reader(input); + + ASSERT_EQ(Success, SkipOptionalImplicitPrimitiveTag(reader, 2)); + ASSERT_FALSE(reader.AtEnd()); +} + +TEST_F(pkixder_universal_types_tests, NoSkipOptionalImplicitConstructedTag) +{ + const uint8_t DER_IMPLICIT_SEQUENCE_WITH_CLASS_NUMBER_1[] = { + 0xA1, + 0x03, + 0x05, + 0x01, + 0x00, + }; + Input input(DER_IMPLICIT_SEQUENCE_WITH_CLASS_NUMBER_1); + Reader reader(input); + + ASSERT_EQ(Success, SkipOptionalImplicitPrimitiveTag(reader, 1)); + ASSERT_FALSE(reader.AtEnd()); +} diff --git a/security/nss/lib/mozpkix/include/pkix/pkixder.h b/security/nss/lib/mozpkix/include/pkix/pkixder.h index 3aae0ecf69..379106ef4d 100644 --- a/security/nss/lib/mozpkix/include/pkix/pkixder.h +++ b/security/nss/lib/mozpkix/include/pkix/pkixder.h @@ -114,6 +114,17 @@ inline Result ExpectTagAndSkipValue(Reader& input, uint8_t tag) { return ExpectTagAndGetValue(input, tag, ignoredValue); } +// This skips IMPLICIT OPTIONAL tags that are "primitive" (not constructed), +// given the number in the class of the tag (i.e. the number in the brackets in +// `issuerUniqueID [1] IMPLICIT UniqueIdentifier OPTIONAL`). +inline Result SkipOptionalImplicitPrimitiveTag(Reader& input, + uint8_t numberInClass) { + if (input.Peek(CONTEXT_SPECIFIC | numberInClass)) { + return ExpectTagAndSkipValue(input, CONTEXT_SPECIFIC | numberInClass); + } + return Success; +} + // Like ExpectTagAndGetValue, except the output Input will contain the // encoded tag and length along with the value. inline Result ExpectTagAndGetTLV(Reader& input, uint8_t tag, diff --git a/security/nss/lib/mozpkix/lib/pkixcert.cpp b/security/nss/lib/mozpkix/lib/pkixcert.cpp index a304837382..7789bd57d0 100644 --- a/security/nss/lib/mozpkix/lib/pkixcert.cpp +++ b/security/nss/lib/mozpkix/lib/pkixcert.cpp @@ -105,29 +105,24 @@ BackCert::Init() return rv; } - static const uint8_t CSC = der::CONTEXT_SPECIFIC | der::CONSTRUCTED; - // According to RFC 5280, all fields below this line are forbidden for // certificate versions less than v3. However, for compatibility reasons, // we parse v1/v2 certificates in the same way as v3 certificates. So if // these fields appear in a v1 certificate, they will be used. // Ignore issuerUniqueID if present. - if (tbsCertificate.Peek(CSC | 1)) { - rv = der::ExpectTagAndSkipValue(tbsCertificate, CSC | 1); - if (rv != Success) { - return rv; - } + rv = der::SkipOptionalImplicitPrimitiveTag(tbsCertificate, 1); + if (rv != Success) { + return rv; } // Ignore subjectUniqueID if present. - if (tbsCertificate.Peek(CSC | 2)) { - rv = der::ExpectTagAndSkipValue(tbsCertificate, CSC | 2); - if (rv != Success) { - return rv; - } + rv = der::SkipOptionalImplicitPrimitiveTag(tbsCertificate, 2); + if (rv != Success) { + return rv; } + static const uint8_t CSC = der::CONTEXT_SPECIFIC | der::CONSTRUCTED; rv = der::OptionalExtensions( tbsCertificate, CSC | 3, [this](Reader& extnID, const Input& extnValue, bool critical, diff --git a/security/nss/lib/nss/nss.h b/security/nss/lib/nss/nss.h index 94287ad858..57353dac82 100644 --- a/security/nss/lib/nss/nss.h +++ b/security/nss/lib/nss/nss.h @@ -22,10 +22,10 @@ * The format of the version string should be * ".[.[.]][ ][ ]" */ -#define NSS_VERSION "3.44.2" _NSS_CUSTOMIZED +#define NSS_VERSION "3.44.3" _NSS_CUSTOMIZED #define NSS_VMAJOR 3 #define NSS_VMINOR 44 -#define NSS_VPATCH 2 +#define NSS_VPATCH 3 #define NSS_VBUILD 0 #define NSS_BETA PR_FALSE diff --git a/security/nss/lib/softoken/pkcs11c.c b/security/nss/lib/softoken/pkcs11c.c index 61f55fca28..c30f988386 100644 --- a/security/nss/lib/softoken/pkcs11c.c +++ b/security/nss/lib/softoken/pkcs11c.c @@ -1321,7 +1321,7 @@ NSC_EncryptUpdate(CK_SESSION_HANDLE hSession, } /* encrypt the current padded data */ rv = (*context->update)(context->cipherInfo, pEncryptedPart, - &padoutlen, context->blockSize, context->padBuf, + &padoutlen, maxout, context->padBuf, context->blockSize); if (rv != SECSuccess) { return sftk_MapCryptError(PORT_GetError()); diff --git a/security/nss/lib/softoken/softkver.h b/security/nss/lib/softoken/softkver.h index 1e3e39eef2..77f1118896 100644 --- a/security/nss/lib/softoken/softkver.h +++ b/security/nss/lib/softoken/softkver.h @@ -17,10 +17,10 @@ * The format of the version string should be * ".[.[.]][ ][ ]" */ -#define SOFTOKEN_VERSION "3.44.2" SOFTOKEN_ECC_STRING +#define SOFTOKEN_VERSION "3.44.3" SOFTOKEN_ECC_STRING #define SOFTOKEN_VMAJOR 3 #define SOFTOKEN_VMINOR 44 -#define SOFTOKEN_VPATCH 2 +#define SOFTOKEN_VPATCH 3 #define SOFTOKEN_VBUILD 0 #define SOFTOKEN_BETA PR_FALSE diff --git a/security/nss/lib/util/nssutil.h b/security/nss/lib/util/nssutil.h index 9448425166..98b929978a 100644 --- a/security/nss/lib/util/nssutil.h +++ b/security/nss/lib/util/nssutil.h @@ -19,10 +19,10 @@ * The format of the version string should be * ".[.[.]][ ]" */ -#define NSSUTIL_VERSION "3.44.2" +#define NSSUTIL_VERSION "3.44.3" #define NSSUTIL_VMAJOR 3 #define NSSUTIL_VMINOR 44 -#define NSSUTIL_VPATCH 2 +#define NSSUTIL_VPATCH 3 #define NSSUTIL_VBUILD 0 #define NSSUTIL_BETA PR_FALSE