Update to NSS 3.12.7.

net/third_party/nss/ssl/sslgathr.c

 /*
  * Gather (Read) entire SSL2 records from socket into buffer.  
  *
  * ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
  * The contents of this file are subject to the Mozilla Public License Version
  * 1.1 (the "License"); you may not use this file except in compliance with
  * the License. You may obtain a copy of the License at
  * http://www.mozilla.org/MPL/
@@ skipping 18 matching lines @@
  * in which case the provisions of the GPL or the LGPL are applicable instead
  * of those above. If you wish to allow use of your version of this file only
  * under the terms of either the GPL or the LGPL, and not to allow others to
  * use your version of this file under the terms of the MPL, indicate your
  * decision by deleting the provisions above and replace them with the notice
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
-/* $Id: sslgathr.c,v 1.10 2009/10/16 17:45:35 wtc%google.com Exp $ */
+/* $Id: sslgathr.c,v 1.12 2010/04/25 23:37:38 nelson%bolyard.com Exp $ */
 #include "cert.h"
 #include "ssl.h"
 #include "sslimpl.h"
 #include "sslproto.h"
 
 /* Forward static declarations */
 static SECStatus ssl2_HandleV3HandshakeRecord(sslSocket *ss);
 
 /*
 ** Gather a single record of data from the receiving stream. This code
@@ skipping 215 matching lines @@
                 rv = SECFailure;
                 goto spec_locked_done;
             }
             PORT_Assert(gs->count == gs->offset);
 
             if (gs->offset == 0) {
                 rv = 0;                 /* means EOF. */
                 goto spec_locked_done;
             }
 
-            /* Decrypt the portion of data that we just recieved.
+            /* Decrypt the portion of data that we just received.
             ** Decrypt it in place.
             */
             rv = (*ss->sec.dec)(ss->sec.readcx, pBuf, &nout, gs->offset,
                              pBuf, gs->offset);
             if (rv != SECSuccess) {
                 goto spec_locked_done;
             }
 
 
             /* Have read in all the MAC portion of record 
@@ skipping 10 matching lines @@
                 seq[2] = (unsigned char) (sequenceNumber >> 8);
                 seq[3] = (unsigned char) (sequenceNumber);
 
                 (*ss->sec.hash->begin)(ss->sec.hashcx);
                 (*ss->sec.hash->update)(ss->sec.hashcx, ss->sec.rcvSecret.data,
                                         ss->sec.rcvSecret.len);
                 (*ss->sec.hash->update)(ss->sec.hashcx, pBuf + macLen, 
                                         gs->offset - macLen);
                 (*ss->sec.hash->update)(ss->sec.hashcx, seq, 4);
                 (*ss->sec.hash->end)(ss->sec.hashcx, mac, &macLen, macLen);
+
+                PORT_Assert(macLen == ss->sec.hash->length);
+
+                ssl_ReleaseSpecReadLock(ss);  /******************************/
+
+                if (NSS_SecureMemcmp(mac, pBuf, macLen) != 0) {
+                    /* MAC's didn't match... */
+                    SSL_DBG(("%d: SSL[%d]: mac check failed, seq=%d",
+                             SSL_GETPID(), ss->fd, ss->sec.rcvSequence));
+                    PRINT_BUF(1, (ss, "computed mac:", mac, macLen));
+                    PRINT_BUF(1, (ss, "received mac:", pBuf, macLen));
+                    PORT_SetError(SSL_ERROR_BAD_MAC_READ);
+                    rv = SECFailure;
+                    goto cleanup;
+                }
+            } else {
+                ssl_ReleaseSpecReadLock(ss);  /******************************/
             }
 
-            PORT_Assert(macLen == ss->sec.hash->length);
-
-            ssl_ReleaseSpecReadLock(ss);  /******************************/
-
-            if (NSS_SecureMemcmp(mac, pBuf, macLen) != 0) {
-                /* MAC's didn't match... */
-                SSL_DBG(("%d: SSL[%d]: mac check failed, seq=%d",
-                         SSL_GETPID(), ss->fd, ss->sec.rcvSequence));
-                PRINT_BUF(1, (ss, "computed mac:", mac, macLen));
-                PRINT_BUF(1, (ss, "received mac:", pBuf, macLen));
-                PORT_SetError(SSL_ERROR_BAD_MAC_READ);
-                rv = SECFailure;
-                goto cleanup;
-            }
-
-
-            PORT_Assert(gs->recordPadding + macLen <= gs->offset);
             if (gs->recordPadding + macLen <= gs->offset) {
                 gs->recordOffset  = macLen;
                 gs->readOffset    = macLen;
                 gs->writeOffset   = gs->offset - gs->recordPadding;
                 rv = 1;
             } else {
                 PORT_SetError(SSL_ERROR_BAD_BLOCK_PADDING);
 cleanup:
                 /* nothing in the buffer any more. */
                 gs->recordOffset  = 0;
@@ skipping 139 matching lines @@
     **/
     rv = ssl3_NegotiateVersion(ss, version);
     if (rv != SECSuccess) {
         return rv;
     }
 
     ss->sec.send         = ssl3_SendApplicationData;
 
     return SECSuccess;
 }