Update net/third_party/nss to NSS 3.13.3.

net/third_party/nss/ssl/derive.c

 /*
  * Key Derivation that doesn't use PKCS11
  *
  * ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
  * The contents of this file are subject to the Mozilla Public License Version
  * 1.1 (the "License"); you may not use this file except in compliance with
  * the License. You may obtain a copy of the License at
  * http://www.mozilla.org/MPL/
@@ skipping 18 matching lines @@
  * in which case the provisions of the GPL or the LGPL are applicable instead
  * of those above. If you wish to allow use of your version of this file only
  * under the terms of either the GPL or the LGPL, and not to allow others to
  * use your version of this file under the terms of the MPL, indicate your
  * decision by deleting the provisions above and replace them with the notice
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
-/* $Id: derive.c,v 1.12 2008/06/06 01:16:31 wtc%google.com Exp $ */
+/* $Id: derive.c,v 1.13 2011/03/22 22:15:22 alexei.volkov.bugs%sun.com Exp $ */
 
 #include "ssl.h"        /* prereq to sslimpl.h */
 #include "certt.h"      /* prereq to sslimpl.h */
 #include "keythi.h"     /* prereq to sslimpl.h */
 #include "sslimpl.h"
 #include "blapi.h"
 
 #include "keyhi.h"
 #include "pk11func.h"
 #include "secasn1.h"
@@ skipping 547 matching lines @@
     SECItem           param;
     CK_VERSION        version;
     CK_MECHANISM_TYPE mechanism_array[2];
     SECItem           enc_pms = {siBuffer, NULL, 0};
     PRBool            isTLS = PR_FALSE;
     SSLCipherSuiteInfo csdef;
     PRBool            testrsa = PR_FALSE;
     PRBool            testrsa_export = PR_FALSE;
     PRBool            testecdh = PR_FALSE;
     PRBool            testecdhe = PR_FALSE;
+#ifdef NSS_ENABLE_ECC
+    SECKEYECParams ecParams = { siBuffer, NULL, 0 };
+#endif
 
     if (!cert || !srvPrivkey || !ciphersuites || !pcanbypass) {
         PORT_SetError(SEC_ERROR_INVALID_ARGS);
         return SECFailure;
     }
     
     srvPubkey = CERT_ExtractPublicKey(cert);
     if (!srvPubkey)
         return SECFailure;
         
@@ skipping 79 matching lines @@
             version.minor = 0 /*LSB(clientHelloVersion)*/;
             param.data = (unsigned char *)&version;
             param.len  = sizeof version;
             pms = PK11_KeyGen(slot, CKM_SSL3_PRE_MASTER_KEY_GEN, &param, 0, pwArg);
             PK11_FreeSlot(slot);
             if (!pms)
                 break;
             /* now wrap it */
             enc_pms.len  = SECKEY_PublicKeyStrength(srvPubkey);
             enc_pms.data = (unsigned char*)PORT_Alloc(enc_pms.len);
+            if (enc_pms.data == NULL) {
+                PORT_SetError(PR_OUT_OF_MEMORY_ERROR);
+                break;
+            }
             irv = PK11_PubWrapSymKey(CKM_RSA_PKCS, srvPubkey, pms, &enc_pms);
             if (irv != SECSuccess) 
                 break;
             PK11_FreeSymKey(pms);
+            pms = NULL;
             /* now do the server side--check the triple bypass first */
             rv = PK11_PrivDecryptPKCS1(srvPrivkey, rsaPmsBuf, &outLen,
                                        sizeof rsaPmsBuf,
                                        (unsigned char *)enc_pms.data,
                                        enc_pms.len);
             /* if decrypt worked we're done with the RSA test */
             if (rv == SECSuccess) {
                 *pcanbypass = PR_TRUE;
                 break;
             }
             /* check for fallback to double bypass */
             target = isTLS ? CKM_TLS_MASTER_KEY_DERIVE
                         : CKM_SSL3_MASTER_KEY_DERIVE;
             pms = PK11_PubUnwrapSymKey(srvPrivkey, &enc_pms,
                                        target, CKA_DERIVE, 0);
             rv = ssl_canExtractMS(pms, isTLS, PR_FALSE, pcanbypass);
             if (rv == SECSuccess && *pcanbypass == PR_FALSE)
                 goto done;
             break;
         }
+
+        /* Check for NULL to avoid double free. 
+         * SECItem_FreeItem sets data NULL in secitem.c#265 
+         */
+        if (enc_pms.data != NULL) {
+            SECITEM_FreeItem(&enc_pms, PR_FALSE);
+        }
 #ifdef NSS_ENABLE_ECC
         for (; (privKeytype == ecKey && ( testecdh || testecdhe)) ||
                (privKeytype == rsaKey && testecdhe); ) {
             CK_MECHANISM_TYPE target;
             SECKEYPublicKey  *keapub = NULL;
             SECKEYPrivateKey *keapriv;
             SECKEYPublicKey  *cpub = NULL; /* client's ephemeral ECDH keys */
             SECKEYPrivateKey *cpriv = NULL;
-            SECKEYECParams    ecParams = { siBuffer, NULL, 0 },
-                              *pecParams;
+            SECKEYECParams   *pecParams = NULL;
 
             if (privKeytype == ecKey && testecdhe) {
                 /* TLS_ECDHE_ECDSA */
                 pecParams = &srvPubkey->u.ec.DEREncodedParams;
             } else if (privKeytype == rsaKey && testecdhe) {
                 /* TLS_ECDHE_RSA */
                 ECName       ec_curve;
                 int              serverKeyStrengthInBits;
                 int              signatureKeyStrength;
                 int              requiredECCbits;
@@ skipping 64 matching lines @@
             pms = PK11_PubDeriveWithKDF(keapriv, cpub, PR_FALSE, NULL, NULL,
                                     CKM_ECDH1_DERIVE,
                                     target,
                                     CKA_DERIVE, 0, CKD_NULL, NULL, NULL);
             rv = ssl_canExtractMS(pms, isTLS, PR_TRUE, pcanbypass);
             SECKEY_DestroyPrivateKey(cpriv);
             SECKEY_DestroyPublicKey(cpub);
             if (testecdhe) {
                 SECKEY_DestroyPrivateKey(keapriv);
                 SECKEY_DestroyPublicKey(keapub);
-                if (privKeytype == rsaKey)
-                    PORT_Free(ecParams.data);
             }
             if (rv == SECSuccess && *pcanbypass == PR_FALSE)
                 goto done;
             break;
         }
+        /* Check for NULL to avoid double free. */
+        if (ecParams.data != NULL) {
+            PORT_Free(ecParams.data);
+            ecParams.data = NULL;
+        }
 #endif /* NSS_ENABLE_ECC */
         if (pms)
             PK11_FreeSymKey(pms);
     }
 
     /* *pcanbypass has been set */
     rv = SECSuccess;
     
   done:
     if (pms)
         PK11_FreeSymKey(pms);
 
-    SECITEM_FreeItem(&enc_pms, PR_FALSE);
+    /* Check for NULL to avoid double free. 
+     * SECItem_FreeItem sets data NULL in secitem.c#265 
+     */
+    if (enc_pms.data != NULL) {
+        SECITEM_FreeItem(&enc_pms, PR_FALSE);
+    }
+#ifdef NSS_ENABLE_ECC
+    if (ecParams.data != NULL) {
+        PORT_Free(ecParams.data);
+        ecParams.data = NULL;
+    }
+#endif /* NSS_ENABLE_ECC */
 
     if (srvPubkey) {
         SECKEY_DestroyPublicKey(srvPubkey);
         srvPubkey = NULL;
     }
 
 
     return rv;
 }