PK11_DecryptWithSymKey and PK11_EncryptWithSymKey have been

patches/nss-aes-gcm.patch

 Index: mozilla/security/nss/lib/freebl/gcm.c
 ===================================================================
---- mozilla/security/nss/lib/freebl/gcm.c       (revision 182578)
+--- mozilla/security/nss/lib/freebl/gcm.c       (revision 190722)
 +++ mozilla/security/nss/lib/freebl/gcm.c       (working copy)
 @@ -230,7 +230,7 @@
         PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
         return SECFailure;
      }
 -    gcm_reverse(T, X, blocksize);
 +    gcm_reverse(T, tmp_buf, blocksize);
      return SECSuccess;
  }
  
-@@ -575,11 +575,11 @@
+@@ -453,7 +453,9 @@
+      * we can hash it */
+     if (ghash->bufLen) {
+        unsigned int needed = PR_MIN(len, blocksize - ghash->bufLen);
+-       PORT_Memcpy(ghash->buffer+ghash->bufLen, buf, needed);
++       if (needed != 0) {
++           PORT_Memcpy(ghash->buffer+ghash->bufLen, buf, needed);
++       }
+        buf += needed;
+        len -= needed;
+        ghash->bufLen += needed;
+@@ -575,11 +577,11 @@
         if (rv != SECSuccess) {
             return SECFailure;
         }
 -       rv = gcmHash_Sync(ghash, blocksize);
 -       if (rv != SECSuccess) {
 -           return SECFailure;
 -       }
      }
 +    rv = gcmHash_Sync(ghash, blocksize);
 +    if (rv != SECSuccess) {
 +       return SECFailure;
 +    }
      return SECSuccess;
  }
  
+@@ -814,7 +816,7 @@
+ 
+     /* get the authentication block */
+     if (inlen < tagBytes) {
+-       PORT_SetError(SEC_ERROR_INVALID_ARGS);
++       PORT_SetError(SEC_ERROR_INPUT_LEN);
+        return SECFailure;
+     }
+ 
 Index: mozilla/security/nss/lib/freebl/rijndael.c
 ===================================================================
---- mozilla/security/nss/lib/freebl/rijndael.c  (revision 182578)
+--- mozilla/security/nss/lib/freebl/rijndael.c  (revision 190722)
 +++ mozilla/security/nss/lib/freebl/rijndael.c  (working copy)
 @@ -1221,7 +1221,7 @@
  {
      int blocksize;
      /* Check args */
 -    if (cx == NULL || output == NULL || input == NULL) {
 +    if (cx == NULL || output == NULL || (input == NULL && inputLen != 0)) {
         PORT_SetError(SEC_ERROR_INVALID_ARGS);
         return SECFailure;
      }
 @@ -1252,7 +1252,7 @@
  {
      int blocksize;
      /* Check args */
 -    if (cx == NULL || output == NULL || input == NULL) {
 +    if (cx == NULL || output == NULL || (input == NULL && inputLen != 0)) {
         PORT_SetError(SEC_ERROR_INVALID_ARGS);
         return SECFailure;
      }
 Index: mozilla/security/nss/lib/pk11wrap/pk11mech.c
 ===================================================================
---- mozilla/security/nss/lib/pk11wrap/pk11mech.c        (revision 182578)
+--- mozilla/security/nss/lib/pk11wrap/pk11mech.c        (revision 190722)
 +++ mozilla/security/nss/lib/pk11wrap/pk11mech.c        (working copy)
 @@ -221,6 +221,10 @@
         return CKK_CAMELLIA;
      case CKM_AES_ECB:
      case CKM_AES_CBC:
 +    case CKM_AES_CCM:
 +    case CKM_AES_CTR:
 +    case CKM_AES_CTS:
 +    case CKM_AES_GCM:
      case CKM_AES_MAC:
      case CKM_AES_MAC_GENERAL:
      case CKM_AES_CBC_PAD: