Uprev NSS to 3.18 RTM

nss/lib/certdb/certdb.c

 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 /*
  * Certificate handling code
  */
 
 #include "nssilock.h"
 #include "prmon.h"
@@ skipping 1033 matching lines @@
 }
 
 /* These routines should probably be combined with the cert
  * routines using an common extraction routine.
  */
 SECCertTimeValidity
 SEC_CheckCrlTimes(CERTCrl *crl, PRTime t) {
     PRTime notBefore, notAfter, llPendingSlop, tmp1;
     SECStatus rv;
 
+    if (!crl) {
+        PORT_SetError(SEC_ERROR_INVALID_ARGS);
+        return(secCertTimeUndetermined);
+    }
+
     rv = SEC_GetCrlTimes(crl, &notBefore, &notAfter);
     
     if (rv) {
         return(secCertTimeExpired); 
     }
 
     LL_I2L(llPendingSlop, pendingSlop);
     /* convert to micro seconds */
     LL_I2L(tmp1, PR_USEC_PER_SEC);
     LL_MUL(llPendingSlop, llPendingSlop, tmp1);
     LL_SUB(notBefore, notBefore, llPendingSlop);
     if ( LL_CMP( t, <, notBefore ) ) {
+        PORT_SetError(SEC_ERROR_CRL_EXPIRED);
         return(secCertTimeNotValidYet);
     }
 
     /* If next update is omitted and the test for notBefore passes, then
        we assume that the crl is up to date.
      */
     if ( LL_IS_ZERO(notAfter) ) {
         return(secCertTimeValid);
     }
 
     if ( LL_CMP( t, >, notAfter) ) {
+        PORT_SetError(SEC_ERROR_CRL_EXPIRED);
         return(secCertTimeExpired);
     }
 
     return(secCertTimeValid);
 }
 
 PRBool
 SEC_CrlIsNewer(CERTCrl *inNew, CERTCrl *old) {
     PRTime newNotBefore, newNotAfter;
     PRTime oldNotBefore, oldNotAfter;
@@ skipping 331 matching lines @@
 
 
 SECStatus
 cert_VerifySubjectAltName(const CERTCertificate *cert, const char *hn)
 {
     PLArenaPool *     arena          = NULL;
     CERTGeneralName * nameList       = NULL;
     CERTGeneralName * current;
     char *            cn;
     int               cnBufLen;
-    unsigned int      hnLen;
     int               DNSextCount    = 0;
     int               IPextCount     = 0;
     PRBool            isIPaddr       = PR_FALSE;
     SECStatus         rv             = SECFailure;
     SECItem           subAltName;
     PRNetAddr         netAddr;
     char              cnbuf[128];
 
     subAltName.data = NULL;
-    hnLen    = strlen(hn);
     cn       = cnbuf;
     cnBufLen = sizeof cnbuf;
 
     rv = CERT_FindCertExtension(cert, SEC_OID_X509_SUBJECT_ALT_NAME, 
                                 &subAltName);
     if (rv != SECSuccess) {
         goto fail;
     }
     isIPaddr = (PR_SUCCESS == PR_StringToNetAddr(hn, &netAddr));
     rv = SECFailure;
@@ skipping 855 matching lines @@
 }
 
 /*
  * NOTE - don't allow encode of govt-approved or invisible bits
  */
 SECStatus
 CERT_DecodeTrustString(CERTCertTrust *trust, const char *trusts)
 {
     unsigned int i;
     unsigned int *pflags;
-    
+
     if (!trust) {
         PORT_SetError(SEC_ERROR_INVALID_ARGS);
         return SECFailure;
     }
     trust->sslFlags = 0;
     trust->emailFlags = 0;
     trust->objectSigningFlags = 0;
     if (!trusts) {
         PORT_SetError(SEC_ERROR_INVALID_ARGS);
         return SECFailure;
     }
 
     pflags = &trust->sslFlags;
-    
+
     for (i=0; i < PORT_Strlen(trusts); i++) {
         switch (trusts[i]) {
           case 'p':
               *pflags = *pflags | CERTDB_TERMINAL_RECORD;
               break;
 
           case 'P':
               *pflags = *pflags | CERTDB_TRUSTED | CERTDB_TERMINAL_RECORD;
               break;
 
@@ skipping 25 matching lines @@
               break;
 
           case ',':
               if ( pflags == &trust->sslFlags ) {
                   pflags = &trust->emailFlags;
               } else {
                   pflags = &trust->objectSigningFlags;
               }
               break;
           default:
+              PORT_SetError(SEC_ERROR_INVALID_ARGS);
               return SECFailure;
         }
     }
 
     return SECSuccess;
 }
 
 static void
 EncodeFlags(char *trusts, unsigned int flags)
 {
@@ skipping 882 matching lines @@
     CERTCertificate *cert = NULL;
     SECItem *derCert;
 
     derCert = cert_FindDERCertBySubjectKeyID(subjKeyID);
     if (derCert) {
         cert = CERT_FindCertByDERCert(handle, derCert);
         SECITEM_FreeItem(derCert, PR_TRUE);
     }
     return cert;
 }