When performing an SSL renegotiation and requesting a certificate status, clear any existing certif…

net/third_party/nss/ssl/ssl3ext.c

Index: net/third_party/nss/ssl/ssl3ext.c
diff --git a/net/third_party/nss/ssl/ssl3ext.c b/net/third_party/nss/ssl/ssl3ext.c
index 23bb44b2060463df2d7745c4bc1b4e924d25658e..5874b818567ce8a1f222bdf069f4d15397217542 100644
--- a/net/third_party/nss/ssl/ssl3ext.c
+++ b/net/third_party/nss/ssl/ssl3ext.c
@@ -733,6 +733,11 @@ ssl3_ClientSendStatusRequestXtn(sslSocket * ss, PRBool append,
     if (!ss->opt.enableOCSPStapling)
 	return 0;
 
+    ss->ssl3.hs.may_get_cert_status = PR_FALSE;

[agl, 2013/02/21 14:57:02]

Is ssl3_HandleHelloRequest a better place for this? This fix doesn't really
depend on whether or not we send a StatusRequest extension or not on the
renegotiation.

+    if (ss->ssl3.hs.cert_status.data) {
+	SECITEM_FreeItem(&ss->ssl3.hs.cert_status, PR_FALSE);
+    }
+
     /* extension_type (2-bytes) +
      * length(extension_data) (2-bytes) +
      * status_type (1) +