Update NSS to NSS 3.14 Beta 1.

mozilla/security/nss/lib/pki/pkibase.c

 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifdef DEBUG
 static const char CVS_ID[] = "@(#) $RCSfile: pkibase.c,v $ $Revision: 1.36 $ $Date: 2012/07/27 21:41:52 $";
 #endif /* DEBUG */
 
 #ifndef DEV_H
 #include "dev.h"
@@ skipping 416 matching lines @@
 
 NSS_IMPLEMENT NSSCertificate * 
 nssCertificateArray_FindBestCertificate (
   NSSCertificate **certs, 
   NSSTime *timeOpt,
   const NSSUsage *usage,
   NSSPolicies *policiesOpt
 )
 {
     NSSCertificate *bestCert = NULL;
+    nssDecodedCert *bestdc = NULL;
     NSSTime *time, sTime;
-    PRBool haveUsageMatch = PR_FALSE;
+    PRBool bestCertMatches = PR_FALSE;
     PRBool thisCertMatches;
+    PRBool bestCertIsValidAtTime = PR_FALSE;
+    PRBool bestCertIsTrusted = PR_FALSE;
 
     if (timeOpt) {
         time = timeOpt;
     } else {
         NSSTime_Now(&sTime);
         time = &sTime;
     }
     if (!certs) {
         return (NSSCertificate *)NULL;
     }
     for (; *certs; certs++) {
-        nssDecodedCert *dc, *bestdc;
+        nssDecodedCert *dc;
         NSSCertificate *c = *certs;
         dc = nssCertificate_GetDecoding(c);
         if (!dc) continue;
         thisCertMatches = dc->matchUsage(dc, usage);
         if (!bestCert) {
             /* always take the first cert, but remember whether or not
              * the usage matched 
              */
             bestCert = nssCertificate_AddRef(c);
-            haveUsageMatch = thisCertMatches;
+            bestCertMatches = thisCertMatches;
+            bestdc = dc;
             continue;
         } else {
-            if (haveUsageMatch && !thisCertMatches) {
+            if (bestCertMatches && !thisCertMatches) {
                 /* if already have a cert for this usage, and if this cert 
                  * doesn't have the correct usage, continue
                  */
                 continue;
-            } else if (!haveUsageMatch && thisCertMatches) {
+            } else if (!bestCertMatches && thisCertMatches) {
                 /* this one does match usage, replace the other */
                 nssCertificate_Destroy(bestCert);
                 bestCert = nssCertificate_AddRef(c);
-                haveUsageMatch = PR_TRUE;
+                bestCertMatches = thisCertMatches;
+                bestdc = dc;
                 continue;
             }
             /* this cert match as well as any cert we've found so far, 
              * defer to time/policies 
              * */
         }
-        bestdc = nssCertificate_GetDecoding(bestCert);
-        if (!bestdc) {
-            nssCertificate_Destroy(bestCert);
-            bestCert = nssCertificate_AddRef(c);
-            continue;
-        }
         /* time */
-        if (bestdc->isValidAtTime(bestdc, time)) {
+        if (bestCertIsValidAtTime || bestdc->isValidAtTime(bestdc, time)) {
             /* The current best cert is valid at time */
+            bestCertIsValidAtTime = PR_TRUE;
             if (!dc->isValidAtTime(dc, time)) {
                 /* If the new cert isn't valid at time, it's not better */
                 continue;
             }
         } else {
             /* The current best cert is not valid at time */
             if (dc->isValidAtTime(dc, time)) {
                 /* If the new cert is valid at time, it's better */
                 nssCertificate_Destroy(bestCert);
                 bestCert = nssCertificate_AddRef(c);
+                bestdc = dc;
+                bestCertIsValidAtTime = PR_TRUE;
+                continue;
             }
         }
-        /* either they are both valid at time, or neither valid; 
-         * take the newer one
+        /* Either they are both valid at time, or neither valid.
+         * If only one is trusted for this usage, take it.
          */
+        if (bestCertIsTrusted || bestdc->isTrustedForUsage(bestdc, usage)) {
+            bestCertIsTrusted = PR_TRUE;
+            if (!dc->isTrustedForUsage(dc, usage)) {
+                continue;
+            }
+        } else {
+            /* The current best cert is not trusted */
+            if (dc->isTrustedForUsage(dc, usage)) {
+                /* If the new cert is trusted, it's better */
+                nssCertificate_Destroy(bestCert);
+                bestCert = nssCertificate_AddRef(c);
+                bestdc = dc;
+                bestCertIsTrusted = PR_TRUE;
+                continue;
+            }
+        }
+        /* Otherwise, take the newer one. */
         if (!bestdc->isNewerThan(bestdc, dc)) {
             nssCertificate_Destroy(bestCert);
             bestCert = nssCertificate_AddRef(c);
+            bestdc = dc;
+            continue;
         }
         /* policies */
         /* XXX later -- defer to policies */
     }
     return bestCert;
 }
 
 NSS_IMPLEMENT PRStatus
 nssCertificateArray_Traverse (
   NSSCertificate **certs,
@@ skipping 710 matching lines @@
 }
 
 NSS_IMPLEMENT PRTime
 NSSTime_GetPRTime (
   NSSTime *time
 )
 {
   return time->prTime;
 }