Update NSS to NSS 3.14 pre-release snapshot 2012-06-26 01:00:00 PDT.

mozilla/security/nss/lib/cryptohi/secvfy.c

 /*
  * Verification stuff.
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 /* $Id: secvfy.c,v 1.30 2012/06/25 21:48:39 rrelyea%redhat.com Exp $ */
 
 #include <stdio.h>
 #include "cryptohi.h"
@@ skipping 84 matching lines @@
      *
      * Use the "buffer" union member to reference the buffer.
      * Note: do not take the size of the "buffer" union member.  Take
      * the size of the union or some other union member instead.
      */
     union {
         unsigned char buffer[1];
 
         /* the digest in the decrypted RSA signature */
         unsigned char rsadigest[HASH_LENGTH_MAX];
         /* the full DSA signature... 40 bytes */

[wtc, 2012/11/08 01:57:36]

"40 bytes" should be updated.

-        unsigned char dsasig[DSA_SIGNATURE_LEN];
+        unsigned char dsasig[DSA_MAX_SIGNATURE_LEN];
         /* the full ECDSA signature */
         unsigned char ecdsasig[2 * MAX_ECKEY_LEN];
     } u;
     unsigned int rsadigestlen;
     void * wincx;
     void *hashcx;
     const SECHashObject *hashobj;
     SECOidTag encAlg;  /* enc alg */
     PRBool hasSignature;  /* true if the signature was provided in the
                            * VFY_CreateContext call.  If false, the
@@ skipping 86 matching lines @@
       case SEC_OID_ISO_SHA1_WITH_RSA_SIGNATURE:
         *hashalg = SEC_OID_SHA1;
         break;
       case SEC_OID_PKCS1_RSA_ENCRYPTION:
       case SEC_OID_PKCS1_RSA_PSS_SIGNATURE:
         *hashalg = SEC_OID_UNKNOWN; /* get it from the RSA signature */
         break;
 
       case SEC_OID_ANSIX962_ECDSA_SHA224_SIGNATURE:
       case SEC_OID_PKCS1_SHA224_WITH_RSA_ENCRYPTION:
+      case SEC_OID_NIST_DSA_SIGNATURE_WITH_SHA224_DIGEST:
         *hashalg = SEC_OID_SHA224;
         break;
       case SEC_OID_ANSIX962_ECDSA_SHA256_SIGNATURE:
       case SEC_OID_PKCS1_SHA256_WITH_RSA_ENCRYPTION:
+      case SEC_OID_NIST_DSA_SIGNATURE_WITH_SHA256_DIGEST:
         *hashalg = SEC_OID_SHA256;
         break;
       case SEC_OID_ANSIX962_ECDSA_SHA384_SIGNATURE:
       case SEC_OID_PKCS1_SHA384_WITH_RSA_ENCRYPTION:
         *hashalg = SEC_OID_SHA384;
         break;
       case SEC_OID_ANSIX962_ECDSA_SHA512_SIGNATURE:
       case SEC_OID_PKCS1_SHA512_WITH_RSA_ENCRYPTION:
         *hashalg = SEC_OID_SHA512;
         break;
@@ skipping 73 matching lines @@
       case SEC_OID_PKCS1_SHA512_WITH_RSA_ENCRYPTION:
         *encalg = SEC_OID_PKCS1_RSA_ENCRYPTION;
         break;
       case SEC_OID_PKCS1_RSA_PSS_SIGNATURE:
         *encalg = SEC_OID_PKCS1_RSA_PSS_SIGNATURE;
         break;
 
       /* what about normal DSA? */
       case SEC_OID_ANSIX9_DSA_SIGNATURE_WITH_SHA1_DIGEST:
       case SEC_OID_BOGUS_DSA_SIGNATURE_WITH_SHA1_DIGEST:
+      case SEC_OID_NIST_DSA_SIGNATURE_WITH_SHA224_DIGEST:
+      case SEC_OID_NIST_DSA_SIGNATURE_WITH_SHA256_DIGEST:
         *encalg = SEC_OID_ANSIX9_DSA_SIGNATURE;
         break;
       case SEC_OID_MISSI_DSS:
       case SEC_OID_MISSI_KEA_DSS:
       case SEC_OID_MISSI_KEA_DSS_OLD:
       case SEC_OID_MISSI_DSS_OLD:
         *encalg = SEC_OID_MISSI_DSS;
         break;
       case SEC_OID_ANSIX962_ECDSA_SHA1_SIGNATURE:
       case SEC_OID_ANSIX962_ECDSA_SHA224_SIGNATURE:
@@ skipping 400 matching lines @@
 {
     SECOidTag encAlg, hashAlg;
     SECOidTag sigAlg = SECOID_GetAlgorithmTag((SECAlgorithmID *)sigAlgorithm);
     SECStatus rv     = sec_DecodeSigAlg(key, sigAlg, 
                                 &sigAlgorithm->parameters, &encAlg, &hashAlg);
     if (rv != SECSuccess) {
         return rv;
     }
     return vfy_VerifyData(buf, len, key, sig, encAlg, hashAlg, hash, wincx);
 }