Separate the key setting code in the constructor of HMAC class into the Init...

base/hmac_nss.cc

 // Copyright (c) 2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/hmac.h"
 
 #include <nss.h>
 #include <pk11pub.h>
 
 #include "base/logging.h"
@@ skipping 24 matching lines @@
 
 }  // namespace
 
 namespace base {
 
 struct HMACPlatformData {
   ScopedNSSSlot slot_;
   ScopedNSSSymKey sym_key_;
 };
 
-HMAC::HMAC(HashAlgorithm hash_alg, const unsigned char* key, int key_length)
+HMAC::HMAC(HashAlgorithm hash_alg)
     : hash_alg_(hash_alg), plat_(new HMACPlatformData()) {
+  // Only SHA-1 digest is supported now.
   DCHECK(hash_alg_ == SHA1);
+}
 
+bool HMAC::Init(const unsigned char *key, int key_length) {
   base::EnsureNSSInit();
 
+  if (hash_alg_ != SHA1) {
+    NOTREACHED();
+    return false;
+  }
+
+  if (plat_->slot_.get() || plat_->slot_.get()) {
+    // Init must not be called more than twice on the same HMAC object.
+    NOTREACHED();
+    return false;
+  }
+
   plat_->slot_.reset(PK11_GetBestSlot(CKM_SHA_1_HMAC, NULL));
-  CHECK(plat_->slot_.get());
+  if (!plat_->slot_.get()) {
+    NOTREACHED();
+    return false;
+  }
 
   SECItem key_item;
   key_item.type = siBuffer;
   key_item.data = const_cast<unsigned char*>(key);  // NSS API isn't const.
   key_item.len = key_length;
 
   plat_->sym_key_.reset(PK11_ImportSymKey(plat_->slot_.get(),
                                           CKM_SHA_1_HMAC,
                                           PK11_OriginUnwrap,
                                           CKA_SIGN,
                                           &key_item,
                                           NULL));
-  CHECK(plat_->sym_key_.get());
+  if (!plat_->sym_key_.get()) {
+    NOTREACHED();
+    return false;
+  }
+
+  return true;
 }
 
 HMAC::~HMAC() {
 }
 
 bool HMAC::Sign(const std::string& data,
                 unsigned char* digest,
                 int digest_length) {
+  if (!plat_->sym_key_.get()) {
+    // Init has not been called before Sign.
+    NOTREACHED();
+    return false;
+  }
+
   SECItem param = { siBuffer, NULL, 0 };
   ScopedNSSContext context(PK11_CreateContextBySymKey(CKM_SHA_1_HMAC,
                                                       CKA_SIGN,
                                                       plat_->sym_key_.get(),
                                                       &param));
   if (!context.get()) {
     NOTREACHED();
     return false;
   }
 
@@ skipping 13 matching lines @@
   if (PK11_DigestFinal(context.get(),
                        digest, &len, digest_length) != SECSuccess) {
     NOTREACHED();
     return false;
   }
 
   return true;
 }
 
 }  // namespace base