Update to NSS 3.14.3 Beta 1 for the TLS CBC constant-time

mozilla/security/nss/lib/freebl/md5.c

Index: mozilla/security/nss/lib/freebl/md5.c
===================================================================
--- mozilla/security/nss/lib/freebl/md5.c	(revision 180595)
+++ mozilla/security/nss/lib/freebl/md5.c	(working copy)
@@ -523,7 +523,8 @@
 	md5_compress(cx, cx->u.w);
 
 	/* Copy the resulting values out of the chain variables into return buf. */
-	*digestLen = MD5_HASH_LEN;
+	if (digestLen)
+		*digestLen = MD5_HASH_LEN;
 #ifndef IS_LITTLE_ENDIAN
 	cx->cv[0] = lendian(cx->cv[0]);
 	cx->cv[1] = lendian(cx->cv[1]);
@@ -533,6 +534,32 @@
 	memcpy(digest, cx->cv, MD5_HASH_LEN);
 }
 
+void
+MD5_EndRaw(MD5Context *cx, unsigned char *digest,
+           unsigned int *digestLen, unsigned int maxDigestLen)
+{
+#ifndef IS_LITTLE_ENDIAN
+	PRUint32 tmp;
+#endif
+	PRUint32 cv[4];
+
+	if (maxDigestLen < MD5_HASH_LEN) {
+		PORT_SetError(SEC_ERROR_INVALID_ARGS);
+		return;
+	}
+
+	memcpy(cv, cx->cv, sizeof(cv));

[wtc, 2013/02/08 02:17:52]

Why do the <Hash>_EndRaw functions need to copy the
result in the |cx| to a local buffer and swap the bytes
there?

[agl, 2013/02/08 02:26:03]

(Late - brain may not be working.)

The EndRaw functions are called multiple times on a given hash and they cannot
be destructive. When hashing a message we'll hash most of it, EndRaw, hash
another block, EndRaw, etc.

That's because the point where we stop taking EndRaw is secret, so we always
EndRaw for every block that might contain the end and pick the result from the
right one (in constant time).

+#ifndef IS_LITTLE_ENDIAN
+	cv[0] = lendian(cv[0]);
+	cv[1] = lendian(cv[1]);
+	cv[2] = lendian(cv[2]);
+	cv[3] = lendian(cv[3]);
+#endif
+	memcpy(digest, cv, MD5_HASH_LEN);
+	if (digestLen)
+		*digestLen = MD5_HASH_LEN;
+}
+
 unsigned int 
 MD5_FlattenSize(MD5Context *cx)
 {