Merge NSS_3_14_2_RTM.

mozilla/security/nss/lib/pki/pki3hack.c

 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifdef DEBUG
-static const char CVS_ID[] = "@(#) $RCSfile: pki3hack.c,v $ $Revision: 1.109 $ $Date: 2012/07/27 21:41:52 $";
+static const char CVS_ID[] = "@(#) $RCSfile: pki3hack.c,v $ $Revision: 1.111 $ $Date: 2013/01/07 04:11:51 $";
 #endif /* DEBUG */
 
 /*
  * Hacks to integrate NSS 3.4 and NSS 4.0 certificates.
  */
 
 #ifndef NSSPKI_H
 #include "nsspki.h"
 #endif /* NSSPKI_H */
 
@@ skipping 781 matching lines @@
             c->serial.data = cc->serialNumber.data;
             c->serial.size = cc->serialNumber.len;
             nssTrust = nssTrustDomain_FindTrustForCertificate(context->td, c);
         }
         if (nssTrust) {
             trust = cert_trust_from_stan_trust(nssTrust, cc->arena);
             if (trust) {
                 /* we should destroy cc->trust before replacing it, but it's
                    allocated in cc->arena, so memory growth will occur on each
                    refresh */
+                CERT_LockCertTrust(cc);
                 cc->trust = trust;
+                CERT_UnlockCertTrust(cc);
             }
             nssTrust_Destroy(nssTrust);
         }
     } else if (instance) {
         /* slot */
         if (cc->slot != instance->token->pk11slot) {
             if (cc->slot) {
                 PK11_FreeSlot(cc->slot);
             }
             cc->slot = PK11_ReferenceSlot(instance->token->pk11slot);
         }
         cc->ownSlot = PR_TRUE;
         /* pkcs11ID */
         cc->pkcs11ID = instance->handle;
         /* trust */
         trust = nssTrust_GetCERTCertTrustForCert(c, cc);
         if (trust) {
             /* we should destroy cc->trust before replacing it, but it's
                allocated in cc->arena, so memory growth will occur on each
                refresh */
+            CERT_LockCertTrust(cc);
             cc->trust = trust;
+            CERT_UnlockCertTrust(cc);
         }
         nssCryptokiObject_Destroy(instance);
     } 
     /* database handle is now the trust domain */
     cc->dbhandle = c->object.trustDomain;
     /* subjectList ? */
     /* istemp and isperm are supported in NSS 3.4 */
     cc->istemp = PR_FALSE; /* CERT_NewTemp will override this */
     cc->isperm = PR_TRUE;  /* by default */
     /* pointer back */
     cc->nssCertificate = c;
     if (trust) {
         /* force the cert type to be recomputed to include trust info */
         PRUint32 nsCertType = cert_ComputeCertType(cc);
 
         /* Assert that it is safe to cast &cc->nsCertType to "PRInt32 *" */
         PORT_Assert(sizeof(cc->nsCertType) == sizeof(PRInt32));
         PR_ATOMIC_SET((PRInt32 *)&cc->nsCertType, nsCertType);
     }
 }
 
 static CERTCertificate *
 stan_GetCERTCertificate(NSSCertificate *c, PRBool forceUpdate)
 {
     nssDecodedCert *dc = NULL;
     CERTCertificate *cc = NULL;
+    CERTCertTrust certTrust;
 
     nssPKIObject_Lock(&c->object);
 
     dc = c->decoding;
     if (!dc) {
         dc = nssDecodedPKIXCertificate_Create(NULL, &c->encoding);
         if (!dc) {
             goto loser;
         }
         cc = (CERTCertificate *)dc->data;
@@ skipping 14 matching lines @@
         }
     }
     cc = (CERTCertificate *)dc->data;
     PORT_Assert(cc);
     if (!cc) {
         nss_SetError(NSS_ERROR_INTERNAL_ERROR);
         goto loser;
     }
     if (!cc->nssCertificate || forceUpdate) {
         fill_CERTCertificateFields(c, cc, forceUpdate);
-    } else if (!cc->trust && !c->object.cryptoContext) {
+    } else if (CERT_GetCertTrust(cc, &certTrust) != SECSuccess &&
+               !c->object.cryptoContext) {
         /* if it's a perm cert, it might have been stored before the
          * trust, so look for the trust again.  But a temp cert can be
          * ignored.
          */
         CERTCertTrust* trust = NULL;
         trust = nssTrust_GetCERTCertTrustForCert(c, cc);
+
+        CERT_LockCertTrust(cc);
         cc->trust = trust;
+        CERT_UnlockCertTrust(cc);
     }
 
   loser:
     nssPKIObject_Unlock(&c->object);
     return cc;
 }
 
 NSS_IMPLEMENT CERTCertificate *
 STAN_ForceCERTCertificateUpdate(NSSCertificate *c)
 {
@@ skipping 171 matching lines @@
 NSS_EXTERN PRStatus
 STAN_ChangeCertTrust(CERTCertificate *cc, CERTCertTrust *trust)
 {
     PRStatus nssrv;
     NSSCertificate *c = STAN_GetNSSCertificate(cc);
     NSSToken *tok;
     NSSTrustDomain *td;
     NSSTrust *nssTrust;
     NSSArena *arena;
     CERTCertTrust *oldTrust;
+    CERTCertTrust *newTrust;
     nssListIterator *tokens;
     PRBool moving_object;
     nssCryptokiObject *newInstance;
     nssPKIObject *pkiob;
 
     if (c == NULL) {
-        return SECFailure;
+        return PR_FAILURE;
     }
     oldTrust = nssTrust_GetCERTCertTrustForCert(c, cc);
     if (oldTrust) {
         if (memcmp(oldTrust, trust, sizeof (CERTCertTrust)) == 0) {
             /* ... and the new trust is no different, done) */
             return PR_SUCCESS;
         } else {
             /* take over memory already allocated in cc's arena */
-            cc->trust = oldTrust;
+            newTrust = oldTrust;
         }
     } else {
-        cc->trust = PORT_ArenaAlloc(cc->arena, sizeof(CERTCertTrust));
+        newTrust = PORT_ArenaAlloc(cc->arena, sizeof(CERTCertTrust));
     }
-    memcpy(cc->trust, trust, sizeof(CERTCertTrust));
+    memcpy(newTrust, trust, sizeof(CERTCertTrust));
+    CERT_LockCertTrust(cc);
+    cc->trust = newTrust;
+    CERT_UnlockCertTrust(cc);
     /* Set the NSSCerticate's trust */
     arena = nssArena_Create();
     if (!arena) return PR_FAILURE;
     nssTrust = nss_ZNEW(arena, NSSTrust);
     if (!nssTrust) {
         nssArena_Destroy(arena);
         return PR_FAILURE;
     }
     pkiob = nssPKIObject_Create(arena, NULL, cc->dbhandle, NULL, nssPKILock);
     if (!pkiob) {
@@ skipping 293 matching lines @@
     td = STAN_GetDefaultTrustDomain();
     cc = STAN_GetDefaultCryptoContext();
     printf("\n\nCertificates in the cache:\n");
     nssTrustDomain_DumpCacheInfo(td, cert_dump_iter, NULL);
     printf("\n\nCertificates in the temporary store:\n");
     if (cc->certStore) {
         nssCertificateStore_DumpStoreInfo(cc->certStore, cert_dump_iter, NULL);
     }
 }