Update to NSS 3.14.3 Beta 1 for the TLS CBC constant-time

mozilla/security/nss/lib/freebl/sha_fast.h

 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifndef _SHA_FAST_H_
 #define _SHA_FAST_H_
 
 #include "prlong.h"
 
 #define SHA1_INPUT_LEN 64
@@ skipping 129 matching lines @@
 
 #elif defined(IS_LITTLE_ENDIAN) || defined( SHA1_USING_64_BIT )
 #define SHA_STORE_RESULT \
   if (!((ptrdiff_t)hashout % sizeof(PRUint32))) { \
     SHA_STORE(0); \
     SHA_STORE(1); \
     SHA_STORE(2); \
     SHA_STORE(3); \
     SHA_STORE(4); \
   } else { \
-    ctx->u.w[0] = SHA_HTONL(ctx->H[0]); \
-    ctx->u.w[1] = SHA_HTONL(ctx->H[1]); \
-    ctx->u.w[2] = SHA_HTONL(ctx->H[2]); \
-    ctx->u.w[3] = SHA_HTONL(ctx->H[3]); \
-    ctx->u.w[4] = SHA_HTONL(ctx->H[4]); \

[wtc, 2013/02/08 02:17:52]

Why is it OK to change SHA_STORE_RESULT to *not* modify
the ctx->u.w array?

[agl, 2013/02/08 02:26:03]

SHA_STORE_RESULT is used in End and EndRaw. Previously, End was destructive -
once you called it, you couldn't add more data to the hash. (Not the mention
that it appends the hash padding). Making it non-destructive is thus making it
more general.

-    memcpy(hashout, ctx->u.w, SHA1_LENGTH); \
+    tmpbuf[0] = SHA_HTONL(ctx->H[0]); \
+    tmpbuf[1] = SHA_HTONL(ctx->H[1]); \
+    tmpbuf[2] = SHA_HTONL(ctx->H[2]); \
+    tmpbuf[3] = SHA_HTONL(ctx->H[3]); \
+    tmpbuf[4] = SHA_HTONL(ctx->H[4]); \
+    memcpy(hashout, tmpbuf, SHA1_LENGTH); \
   }
 
 #else
 #define SHA_STORE_RESULT \
   if (!((ptrdiff_t)hashout % sizeof(PRUint32))) { \
     SHA_STORE(0); \
     SHA_STORE(1); \
     SHA_STORE(2); \
     SHA_STORE(3); \
     SHA_STORE(4); \
   } else { \
     memcpy(hashout, ctx->H, SHA1_LENGTH); \
   }
 #endif 
 
 #endif /* _SHA_FAST_H_ */