Merge NSS_3_14_2_RTM.

mozilla/security/nss/lib/softoken/pkcs11c.c

 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 /*
  * This file implements PKCS 11 on top of our existing security modules
  *
  * For more information about PKCS 11 See PKCS 11 Token Inteface Standard.
  *   This implementation has two slots:
  *      slot 1 is our generic crypto support. It does not require login.
  *   It supports Public Key ops, and all they bulk ciphers and hashes. 
@@ skipping 1155 matching lines @@
     /* make sure we're legal */
     crv = sftk_GetContext(hSession,&context,SFTK_DECRYPT,PR_TRUE,&session);
     if (crv != CKR_OK) return crv;
 
     *pulLastPartLen = 0;
     if (!pLastPart) {
         /* caller is checking the amount of remaining data */
         if (context->padDataLength > 0) {
             *pulLastPartLen = context->padDataLength;
         }
-        rv = SECSuccess;
         goto finish;
     }
 
     if (context->doPad) {
         /* decrypt our saved buffer */
         if (context->padDataLength != 0) {
             /* this assumes that pLastPart is big enough to hold the *whole*
              * buffer!!! */
             rv = (*context->update)(context->cipherInfo, pLastPart, &outlen,
                  maxout, context->padBuf, context->blockSize);
-            if (rv == SECSuccess) {
+            if (rv != SECSuccess) {
+                crv = sftk_MapDecryptError(PORT_GetError());
+            } else {
                 unsigned int padSize = 
                             (unsigned int) pLastPart[context->blockSize-1];
                 if ((padSize > context->blockSize) || (padSize == 0)) {
-                    rv = SECFailure;
+                    crv = CKR_ENCRYPTED_DATA_INVALID;
                 } else {
-                    *pulLastPartLen = outlen - padSize;
+                    unsigned int i;
+                    unsigned int badPadding = 0;  /* used as a boolean */
+                    for (i = 0; i < padSize; i++) {
+                        badPadding |=
+                            (unsigned int) pLastPart[context->blockSize-1-i] ^
+                            padSize;
+                    }
+                    if (badPadding) {
+                        crv = CKR_ENCRYPTED_DATA_INVALID;
+                    } else {
+                        *pulLastPartLen = outlen - padSize;
+                    }
                 }
             }
         }
     }
 
     sftk_TerminateOp( session, SFTK_DECRYPT, context );
 finish:
     sftk_FreeSession(session);
-    return (rv == SECSuccess) ? CKR_OK : sftk_MapDecryptError(PORT_GetError());
+    return crv;
 }
 
 /* NSC_Decrypt decrypts encrypted data in a single part. */
 CK_RV NSC_Decrypt(CK_SESSION_HANDLE hSession,
     CK_BYTE_PTR pEncryptedData,CK_ULONG ulEncryptedDataLen,CK_BYTE_PTR pData,
                                                 CK_ULONG_PTR pulDataLen)
 {
     SFTKSession *session;
     SFTKSessionContext *context;
     unsigned int outlen;
@@ skipping 29 matching lines @@
         if (crv2 == CKR_OK) 
             *pulDataLen += finalLen;
         return crv == CKR_OK ? crv2 : crv;
     }
 
     rv = (*context->update)(context->cipherInfo, pData, &outlen, maxoutlen, 
                                         pEncryptedData, ulEncryptedDataLen);
     /* XXX need to do MUCH better error mapping than this. */
     crv = (rv == SECSuccess) ? CKR_OK : sftk_MapDecryptError(PORT_GetError());
     if (rv == SECSuccess && context->doPad) {
-        CK_ULONG padding = pData[outlen - 1];
+        unsigned int padding = pData[outlen - 1];
         if (padding > context->blockSize || !padding) {
             crv = CKR_ENCRYPTED_DATA_INVALID;
-        } else
-            outlen -= padding;
+        } else {
+            unsigned int i;
+            unsigned int badPadding = 0;  /* used as a boolean */
+            for (i = 0; i < padding; i++) {
+                badPadding |= (unsigned int) pData[outlen - 1 - i] ^ padding;
+            }
+            if (badPadding) {
+                crv = CKR_ENCRYPTED_DATA_INVALID;
+            } else {
+                outlen -= padding;
+            }
+        }
     }
     *pulDataLen = (CK_ULONG) outlen;
     sftk_TerminateOp( session, SFTK_DECRYPT, context );
 finish:
     sftk_FreeSession(session);
     return crv;
 }
 
 
 
@@ skipping 5497 matching lines @@
     att = sftk_FindAttribute(key,CKA_VALUE);
     sftk_FreeObject(key);
     if (!att) {
         return CKR_KEY_HANDLE_INVALID;        
     }
     crv = NSC_DigestUpdate(hSession,(CK_BYTE_PTR)att->attrib.pValue,
                            att->attrib.ulValueLen);
     sftk_FreeAttribute(att);
     return crv;
 }