Uprev NSS to 3.18 RTM

nss/lib/pki/tdcache.c

 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifndef PKIM_H
 #include "pkim.h"
 #endif /* PKIM_H */
 
 #ifndef PKIT_H
 #include "pkit.h"
@@ skipping 373 matching lines @@
     PRUint32 numCerts, arrSize;
 };
 
 static void 
 remove_token_certs(const void *k, void *v, void *a)
 {
     NSSCertificate *c = (NSSCertificate *)k;
     nssPKIObject *object = &c->object;
     struct token_cert_dtor *dtor = a;
     PRUint32 i;
+    nssPKIObject_AddRef(object);
     nssPKIObject_Lock(object);
     for (i=0; i<object->numInstances; i++) {
         if (object->instances[i]->token == dtor->token) {
             nssCryptokiObject_Destroy(object->instances[i]);
             object->instances[i] = object->instances[object->numInstances-1];
             object->instances[object->numInstances-1] = NULL;
             object->numInstances--;
             dtor->certs[dtor->numCerts++] = c;
             if (dtor->numCerts == dtor->arrSize) {
                 dtor->arrSize *= 2;
                 dtor->certs = nss_ZREALLOCARRAY(dtor->certs, 
                                                 NSSCertificate *,
                                                 dtor->arrSize);
             }
             break;
         }
     }
     nssPKIObject_Unlock(object);
+    nssPKIObject_Destroy(object);
     return;
 }
 
 /* 
  * Remove all certs for the given token from the cache.  This is
  * needed if the token is removed. 
  */
 NSS_IMPLEMENT PRStatus
 nssTrustDomain_RemoveTokenCertsFromCache (
   NSSTrustDomain *td,
   NSSToken *token
 )
 {
     NSSCertificate **certs;
     PRUint32 i, arrSize = 10;
     struct token_cert_dtor dtor;
     certs = nss_ZNEWARRAY(NULL, NSSCertificate *, arrSize);
     if (!certs) {
         return PR_FAILURE;
     }
     dtor.cache = td->cache;
     dtor.token = token;
     dtor.certs = certs;
     dtor.numCerts = 0;
     dtor.arrSize = arrSize;
     PZ_Lock(td->cache->lock);
-    nssHash_Iterate(td->cache->issuerAndSN, remove_token_certs, (void *)&dtor);
+    nssHash_Iterate(td->cache->issuerAndSN, remove_token_certs, &dtor);
     for (i=0; i<dtor.numCerts; i++) {
         if (dtor.certs[i]->object.numInstances == 0) {
             nssTrustDomain_RemoveCertFromCacheLOCKED(td, dtor.certs[i]);
             dtor.certs[i] = NULL;  /* skip this cert in the second for loop */
+        } else {
+            /* make sure it doesn't disappear on us before we finish */
+            nssCertificate_AddRef(dtor.certs[i]);
         }
     }
     PZ_Unlock(td->cache->lock);
     for (i=0; i<dtor.numCerts; i++) {
         if (dtor.certs[i]) {
             STAN_ForceCERTCertificateUpdate(dtor.certs[i]);
+            nssCertificate_Destroy(dtor.certs[i]);
         }
     }
     nss_ZFreeIf(dtor.certs);
     return PR_SUCCESS;
 }
 
 NSS_IMPLEMENT PRStatus
 nssTrustDomain_UpdateCachedTokenCerts (
   NSSTrustDomain *td,
   NSSToken *token
@@ skipping 580 matching lines @@
         ce->lastHit = PR_Now();
         rvCert = nssCertificate_AddRef(ce->entry.cert);
 #ifdef DEBUG_CACHE
         PR_LOG(s_log, PR_LOG_DEBUG, ("... found, %d hits", ce->hits));
 #endif
     }
     PZ_Unlock(td->cache->lock);
     return rvCert;
 }
 
-static PRStatus
-issuer_and_serial_from_encoding (
-  NSSBER *encoding, 
-  NSSDER *issuer, 
-  NSSDER *serial
-)
-{
-    SECItem derCert, derIssuer, derSerial;
-    SECStatus secrv;
-    derCert.data = (unsigned char *)encoding->data;
-    derCert.len = encoding->size;
-    secrv = CERT_IssuerNameFromDERCert(&derCert, &derIssuer);
-    if (secrv != SECSuccess) {
-        return PR_FAILURE;
-    }
-    secrv = CERT_SerialNumberFromDERCert(&derCert, &derSerial);
-    if (secrv != SECSuccess) {
-        return PR_FAILURE;
-    }
-    issuer->data = derIssuer.data;
-    issuer->size = derIssuer.len;
-    serial->data = derSerial.data;
-    serial->size = derSerial.len;
-    return PR_SUCCESS;
-}
-
 /*
  * Look for a specific cert in the cache
  */
 NSS_IMPLEMENT NSSCertificate *
 nssTrustDomain_GetCertByDERFromCache (
   NSSTrustDomain *td,
   NSSDER *der
 )
 {
     PRStatus nssrv = PR_FAILURE;
     NSSDER issuer, serial;
     NSSCertificate *rvCert;
-    nssrv = issuer_and_serial_from_encoding(der, &issuer, &serial);
+    nssrv = nssPKIX509_GetIssuerAndSerialFromDER(der, &issuer, &serial);
     if (nssrv != PR_SUCCESS) {
         return NULL;
     }
 #ifdef DEBUG_CACHE
     log_item_dump("looking for cert by DER", der);
 #endif
     rvCert = nssTrustDomain_GetCertForIssuerAndSNFromCache(td, 
                                                            &issuer, &serial);
     PORT_Free(issuer.data);
     PORT_Free(serial.data);
@@ skipping 40 matching lines @@
 nssTrustDomain_DumpCacheInfo (
   NSSTrustDomain *td,
   void (* cert_dump_iter)(const void *, void *, void *),
   void *arg
 )
 {
     PZ_Lock(td->cache->lock);
     nssHash_Iterate(td->cache->issuerAndSN, cert_dump_iter, arg);
     PZ_Unlock(td->cache->lock);
 }