Update NSS to 3.21 RTM and NSPR to 4.11 RTM

nss/lib/pk11wrap/pk11cert.c

 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 /*
  * This file manages PKCS #11 instances of certificates.
  */
 
 #include "secport.h"
 #include "seccomon.h"
 #include "secmod.h"
@@ skipping 125 matching lines @@
         SECKEYPublicKey *pubKey= CERT_ExtractPublicKey(cert);
         CK_ATTRIBUTE theTemplate;
 
         if (pubKey == NULL) {
            return PR_FALSE;
         }
 
         PK11_SETATTRS(&theTemplate,0,NULL,0);
         switch (pubKey->keyType) {
         case rsaKey:
+        case rsaPssKey:
+        case rsaOaepKey:
             PK11_SETATTRS(&theTemplate,CKA_MODULUS, pubKey->u.rsa.modulus.data,
                                                 pubKey->u.rsa.modulus.len);
             break;
         case dsaKey:
             PK11_SETATTRS(&theTemplate,CKA_VALUE, pubKey->u.dsa.publicValue.data,
                                                 pubKey->u.dsa.publicValue.len);
             break;
         case dhKey:
             PK11_SETATTRS(&theTemplate,CKA_VALUE, pubKey->u.dh.publicValue.data,
                                                 pubKey->u.dh.publicValue.len);
@@ skipping 65 matching lines @@
  */
 static CERTCertificate *
 pk11_fastCert(PK11SlotInfo *slot, CK_OBJECT_HANDLE certID, 
               CK_ATTRIBUTE *privateLabel, char **nickptr)
 {
     NSSCertificate *c;
     nssCryptokiObject *co = NULL;
     nssPKIObject *pkio;
     NSSToken *token;
     NSSTrustDomain *td = STAN_GetDefaultTrustDomain();
-    PRStatus status;
 
     /* Get the cryptoki object from the handle */
     token = PK11Slot_GetNSSToken(slot);
     if (token->defaultSession) {
         co = nssCryptokiObject_Create(token, token->defaultSession, certID);
     } else {
         PORT_SetError(SEC_ERROR_NO_TOKEN);
     }
     if (!co) {
         return NULL;
@@ skipping 29 matching lines @@
         id.ulValueLen = c->id.size;
 
         *nickptr = pk11_buildNickname(slot, &label, privateLabel, &id);
     }
 
     /* This function may destroy the cert in "c" and all its subordinate
      * structures, and replace the value in "c" with the address of a 
      * different NSSCertificate that it found in the cache.
      * Presumably, the nickname which we just output above remains valid. :)
      */
-    status = nssTrustDomain_AddCertsToCache(td, &c, 1);
+    (void)nssTrustDomain_AddCertsToCache(td, &c, 1);
     return STAN_GetCERTCertificateOrRelease(c);
 }
 
 /*
  * Build an CERTCertificate structure from a PKCS#11 object ID.... certID
  * Must be a CertObject. This code does not explicitly checks that.
  */
 CERTCertificate *
 PK11_MakeCertFromHandle(PK11SlotInfo *slot,CK_OBJECT_HANDLE certID,
                                                 CK_ATTRIBUTE *privateLabel)
@@ skipping 1081 matching lines @@
      * and moduleID is used as its key, with the slot series as its value.
      */
     slotid = SECITEM_AllocItem(NULL, NULL,
                                sizeof(CK_SLOT_ID) + sizeof(SECMODModuleID));
     if (!slotid) {
         PORT_SetError(SEC_ERROR_NO_MEMORY);
         return PR_FAILURE;
     }
     moduleLock = SECMOD_GetDefaultModuleListLock();
     if (!moduleLock) {
+        SECITEM_FreeItem(slotid, PR_TRUE);
         PORT_SetError(SEC_ERROR_NOT_INITIALIZED);
         return PR_FAILURE;
     }
     SECMOD_GetReadLock(moduleLock);
     modules = SECMOD_GetDefaultModuleList();
     for (mlp = modules; mlp; mlp = mlp->next) {
         for (i = 0; i < mlp->module->slotCount; i++) {
             memcpy(slotid->data, &mlp->module->slots[i]->slotID,
                    sizeof(CK_SLOT_ID));
             memcpy(&slotid->data[sizeof(CK_SLOT_ID)], &mlp->module->moduleID,
@@ skipping 39 matching lines @@
                  * slot, initially. Let's check for new tokens...
                  */
                 PK11SlotList *sl = PK11_GetAllTokens(CKM_INVALID_MECHANISM,
                                                      PR_FALSE, PR_FALSE, pwarg);
                 if (sl) {
                     PK11SlotListElement *le;
                     SECItem *slotid = SECITEM_AllocItem(NULL, NULL,
                                    sizeof(CK_SLOT_ID) + sizeof(SECMODModuleID));
                     if (!slotid) {
                         PORT_SetError(SEC_ERROR_NO_MEMORY);
+                        PK11_FreeSlotList(sl);
                         return NULL;
                     }
                     for (le = sl->head; le; le = le->next) {
                         memcpy(slotid->data, &le->slot->slotID,
                                sizeof(CK_SLOT_ID));
                         memcpy(&slotid->data[sizeof(CK_SLOT_ID)],
                                &le->slot->module->moduleID,
                                sizeof(SECMODModuleID));
                         /*
                          * Any changes with the slot since our last check?
@@ skipping 546 matching lines @@
         }
         nssCertificateArray_Destroy(certs);
     }
     return (nssrv == PR_SUCCESS) ? SECSuccess : SECFailure;
 }
 
 SECStatus
 PK11_TraverseCertsForNicknameInSlot(SECItem *nickname, PK11SlotInfo *slot,
         SECStatus(* callback)(CERTCertificate*, void *), void *arg)
 {
-    struct nss3_cert_cbstr pk11cb;
     PRStatus nssrv = PR_SUCCESS;
     NSSToken *token;
     NSSTrustDomain *td;
     NSSUTF8 *nick;
     PRBool created = PR_FALSE;
     nssCryptokiObject **instances;
     nssPKIObjectCollection *collection = NULL;
     NSSCertificate **certs;
     nssList *nameList = NULL;
     nssTokenSearchType tokenOnly = nssTokenSearchType_TokenOnly;
-    pk11cb.callback = callback;
-    pk11cb.arg = arg;
     token = PK11Slot_GetNSSToken(slot);
     if (!nssToken_IsPresent(token)) {
         return SECSuccess;
     }
     if (nickname->data[nickname->len-1] != '\0') {
         nick = nssUTF8_Create(NULL, nssStringType_UTF8String, 
                               nickname->data, nickname->len);
         created = PR_TRUE;
     } else {
         nick = (NSSUTF8 *)nickname->data;
@@ skipping 662 matching lines @@
  * Use of the API should be limited to short-lived tools, which will exit immediately
  * after using this API.
  *
  * If you ignore this warning, your process is TAINTED and will most likely misbehave.
  */
 SECStatus
 __PK11_SetCertificateNickname(CERTCertificate *cert, const char *nickname)
 {
     /* Can't set nickname of temp cert. */
     if (!cert->slot || cert->pkcs11ID == CK_INVALID_HANDLE) {
-        return SEC_ERROR_INVALID_ARGS;
+        PORT_SetError(SEC_ERROR_INVALID_ARGS);
+        return SECFailure;
     }
     return PK11_SetObjectNickname(cert->slot, cert->pkcs11ID, nickname);
 }