Uprev NSS to 3.18 RTM

nss/lib/libpkix/pkix/top/pkix_build.c

 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 /*
  * pkix_build.c
  *
  * Top level buildChain function
  *
  */
 
@@ skipping 642 matching lines @@
         PKIX_RETURN(FORWARDBUILDERSTATE);
 }
 
 /* --Private-BuildChain-Functions------------------------------------------- */
 
 /*
  * FUNCTION: pkix_Build_SortCertComparator
  * DESCRIPTION:
  *
  *  This Function takes two Certificates cast in "obj1" and "obj2",
- *  compares their validity NotAfter dates and returns the result at
- *  "pResult". The comparison key(s) can be expanded by using other
- *  data in the Certificate in the future.
+ *  compares them to determine which is a more preferable certificate
+ *  for chain building. This Function is suitable for use as a
+ *  comparator callback for pkix_List_BubbleSort, setting "*pResult" to
+ *  > 0 if "obj1" is less desirable than "obj2" and < 0 if "obj1"
+ *  is more desirable than "obj2".
  *
  * PARAMETERS:
  *  "obj1"
  *      Address of the PKIX_PL_Object that is a cast of PKIX_PL_Cert.
  *      Must be non-NULL.
  *  "obj2"
  *      Address of the PKIX_PL_Object that is a cast of PKIX_PL_Cert.
  *      Must be non-NULL.
  *  "pResult"
  *      Address where the comparison result is returned. Must be non-NULL.
  *  "plContext"
  *      Platform-specific context pointer.
  * THREAD SAFETY:
  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
  * RETURNS:
  *  Returns NULL if the function succeeds.
  *  Returns a Build Error if the function fails in a non-fatal way
  *  Returns a Fatal Error if the function fails in an unrecoverable way.
  */
 static PKIX_Error *
 pkix_Build_SortCertComparator(
         PKIX_PL_Object *obj1,
         PKIX_PL_Object *obj2,
         PKIX_Int32 *pResult,
         void *plContext)
 {
         PKIX_PL_Date *date1 = NULL;
         PKIX_PL_Date *date2 = NULL;
-        PKIX_Boolean result = PKIX_FALSE;
+        PKIX_Int32 result = 0;
 
         PKIX_ENTER(BUILD, "pkix_Build_SortCertComparator");
         PKIX_NULLCHECK_THREE(obj1, obj2, pResult);
 
         /*
          * For sorting candidate certificates, we use NotAfter date as the
-         * sorted key for now (can be expanded if desired in the future).
+         * comparison key for now (can be expanded if desired in the future).
          *
          * In PKIX_BuildChain, the List of CertStores was reordered so that
          * trusted CertStores are ahead of untrusted CertStores. That sort, or
          * this one, could be taken out if it is determined that it doesn't help
          * performance, or in some way hinders the solution of choosing desired
          * candidates.
          */
 
         PKIX_CHECK(pkix_CheckType(obj1, PKIX_CERT_TYPE, plContext),
                     PKIX_OBJECTNOTCERT);
         PKIX_CHECK(pkix_CheckType(obj2, PKIX_CERT_TYPE, plContext),
                     PKIX_OBJECTNOTCERT);
 
         PKIX_CHECK(PKIX_PL_Cert_GetValidityNotAfter
                 ((PKIX_PL_Cert *)obj1, &date1, plContext),
                 PKIX_CERTGETVALIDITYNOTAFTERFAILED);
 
         PKIX_CHECK(PKIX_PL_Cert_GetValidityNotAfter
                 ((PKIX_PL_Cert *)obj2, &date2, plContext),
                 PKIX_CERTGETVALIDITYNOTAFTERFAILED);
         
         PKIX_CHECK(PKIX_PL_Object_Compare
                 ((PKIX_PL_Object *)date1,
                 (PKIX_PL_Object *)date2,
                 &result,
                 plContext),
                 PKIX_OBJECTCOMPARATORFAILED);
 
-        *pResult = !result;
+        /*
+         * Invert the result, so that if date1 is greater than date2,
+         * obj1 is sorted before obj2. This is because pkix_List_BubbleSort
+         * sorts in ascending order.
+         */
+        *pResult = -result;
 
 cleanup:
 
         PKIX_DECREF(date1);
         PKIX_DECREF(date2);
 
         PKIX_RETURN(BUILD);
 }
 
 /* This local error check macro */
@@ skipping 2994 matching lines @@
                 *pBuildResult = buildResult;
                 buildResult = NULL;
         }
 
 cleanup:
         PKIX_DECREF(buildResult);
         PKIX_DECREF(state);
 
         PKIX_RETURN(BUILD);
 }