Uprev NSS to 3.18 RTM

nss/lib/pki/pki3hack.c

 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 /*
  * Hacks to integrate NSS 3.4 and NSS 4.0 certificates.
  */
 
 #ifndef NSSPKI_H
 #include "nsspki.h"
@@ skipping 229 matching lines @@
     secrv = CERT_KeyFromDERCert(arena, &secDER, &secKey);
     if (secrv != SECSuccess) {
         return NULL;
     }
     rvKey = nssItem_Create(arenaOpt, NULL, secKey.len, (void *)secKey.data);
     PORT_FreeArena(arena,PR_FALSE);
     return rvKey;
 }
 
 NSS_IMPLEMENT PRStatus
-nssPKIX509_GetIssuerAndSerialFromDER(NSSDER *der, NSSArena *arena, 
+nssPKIX509_GetIssuerAndSerialFromDER(NSSDER *der,
                                      NSSDER *issuer, NSSDER *serial)
 {
-    SECStatus secrv;
-    SECItem derCert;
+    SECItem derCert   = { 0 };
     SECItem derIssuer = { 0 };
     SECItem derSerial = { 0 };
-    SECITEM_FROM_NSSITEM(&derCert, der);
-    secrv = CERT_SerialNumberFromDERCert(&derCert, &derSerial);
+    SECStatus secrv;
+    derCert.data = (unsigned char *)der->data;
+    derCert.len = der->size;
+    secrv = CERT_IssuerNameFromDERCert(&derCert, &derIssuer);
     if (secrv != SECSuccess) {
         return PR_FAILURE;
     }
-    (void)nssItem_Create(arena, serial, derSerial.len, derSerial.data);
-    secrv = CERT_IssuerNameFromDERCert(&derCert, &derIssuer);
+    secrv = CERT_SerialNumberFromDERCert(&derCert, &derSerial);
     if (secrv != SECSuccess) {
         PORT_Free(derSerial.data);
         return PR_FAILURE;
     }
-    (void)nssItem_Create(arena, issuer, derIssuer.len, derIssuer.data);
-    PORT_Free(derSerial.data);
-    PORT_Free(derIssuer.data);
+    issuer->data = derIssuer.data;
+    issuer->size = derIssuer.len;
+    serial->data = derSerial.data;
+    serial->size = derSerial.len;
     return PR_SUCCESS;
 }
 
 static NSSItem *
 nss3certificate_getIdentifier(nssDecodedCert *dc)
 {
     NSSItem *rvID;
     CERTCertificate *c = (CERTCertificate *)dc->data;
     rvID = nssItem_Create(NULL, NULL, c->certKey.len, c->certKey.data);
     return rvID;
@@ skipping 567 matching lines @@
     }
 }
 
 static CERTCertificate *
 stan_GetCERTCertificate(NSSCertificate *c, PRBool forceUpdate)
 {
     nssDecodedCert *dc = NULL;
     CERTCertificate *cc = NULL;
     CERTCertTrust certTrust;
 
+    /* make sure object does not go away until we finish */
+    nssPKIObject_AddRef(&c->object);
     nssPKIObject_Lock(&c->object);
 
     dc = c->decoding;
     if (!dc) {
         dc = nssDecodedPKIXCertificate_Create(NULL, &c->encoding);
         if (!dc) {
             goto loser;
         }
         cc = (CERTCertificate *)dc->data;
         PORT_Assert(cc); /* software error */
@@ skipping 29 matching lines @@
         CERTCertTrust* trust = NULL;
         trust = nssTrust_GetCERTCertTrustForCert(c, cc);
 
         CERT_LockCertTrust(cc);
         cc->trust = trust;
         CERT_UnlockCertTrust(cc);
     }
 
   loser:
     nssPKIObject_Unlock(&c->object);
+    nssPKIObject_Destroy(&c->object);
     return cc;
 }
 
 NSS_IMPLEMENT CERTCertificate *
 STAN_ForceCERTCertificateUpdate(NSSCertificate *c)
 {
     if (c->decoding) {
         return stan_GetCERTCertificate(c, PR_TRUE);
     }
     return NULL;
@@ skipping 346 matching lines @@
 ** surviving entries to the front of the object list
 ** and nullifying the rest.
 */
 static PRStatus
 DeleteCertTrustMatchingSlot(PK11SlotInfo *pk11slot, nssPKIObject *tObject)
 {
     int numNotDestroyed = 0;     /* the ones skipped plus the failures */
     int failureCount = 0;        /* actual deletion failures by devices */
     int index;
 
+    nssPKIObject_AddRef(tObject);
     nssPKIObject_Lock(tObject);
     /* Keep going even if a module fails to delete. */
     for (index = 0; index < tObject->numInstances; index++) {
         nssCryptokiObject *instance = tObject->instances[index];
         if (!instance) {
             continue;
         }
 
         /* ReadOnly and not matched treated the same */
         if (PK11_IsReadOnly(instance->token->pk11slot) ||
@@ skipping 13 matching lines @@
 
     }
     if (numNotDestroyed == 0) {
         nss_ZFreeIf(tObject->instances);
         tObject->numInstances = 0;
     } else {
         tObject->numInstances = numNotDestroyed;
     }
 
     nssPKIObject_Unlock(tObject);
+    nssPKIObject_Destroy(tObject);
 
     return failureCount == 0 ? PR_SUCCESS : PR_FAILURE;
 }
 
 /*
 ** Delete trust objects matching the slot of the given certificate.
 ** Returns an error if any device fails to delete. 
 */
 NSS_EXTERN PRStatus
 STAN_DeleteCertTrustMatchingSlot(NSSCertificate *c)
 {
     PRStatus nssrv = PR_SUCCESS;
 
     NSSTrustDomain *td = STAN_GetDefaultTrustDomain();
     NSSTrust *nssTrust = nssTrustDomain_FindTrustForCertificate(td, c);
     /* caller made sure nssTrust isn't NULL */
     nssPKIObject *tobject = &nssTrust->object;
     nssPKIObject *cobject = &c->object;
     int i;
 
     /* Iterate through the cert and trust object instances looking for
      * those with matching pk11 slots to delete. Even if some device
      * can't delete we keep going. Keeping a status variable for the
      * loop so that once it's failed the other gets set.
      */
     NSSRWLock_LockRead(td->tokensLock);
+    nssPKIObject_AddRef(cobject);
     nssPKIObject_Lock(cobject);
     for (i = 0; i < cobject->numInstances; i++) {
         nssCryptokiObject *cInstance = cobject->instances[i];
         if (cInstance && !PK11_IsReadOnly(cInstance->token->pk11slot)) {
                 PRStatus status;
             if (!tobject->numInstances || !tobject->instances) continue;
             status = DeleteCertTrustMatchingSlot(cInstance->token->pk11slot, tobject);
             if (status == PR_FAILURE) {
                 /* set the outer one but keep going */
                 nssrv = PR_FAILURE;
             }
         }
     }
     nssPKIObject_Unlock(cobject);
+    nssPKIObject_Destroy(cobject);
     NSSRWLock_UnlockRead(td->tokensLock);
     return nssrv;
 }
 
 /* CERT_TraversePermCertsForSubject */
 NSS_IMPLEMENT PRStatus
 nssTrustDomain_TraverseCertificatesBySubject (
   NSSTrustDomain *td,
   NSSDER *subject,
   PRStatus (*callback)(NSSCertificate *c, void *arg),
@@ skipping 66 matching lines @@
     td = STAN_GetDefaultTrustDomain();
     cc = STAN_GetDefaultCryptoContext();
     printf("\n\nCertificates in the cache:\n");
     nssTrustDomain_DumpCacheInfo(td, cert_dump_iter, NULL);
     printf("\n\nCertificates in the temporary store:\n");
     if (cc->certStore) {
         nssCertificateStore_DumpStoreInfo(cc->certStore, cert_dump_iter, NULL);
     }
 }