Update NSS to 3.21 RTM and NSPR to 4.11 RTM

nss/lib/pki/pki3hack.c

 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 /*
  * Hacks to integrate NSS 3.4 and NSS 4.0 certificates.
  */
 
 #ifndef NSSPKI_H
 #include "nsspki.h"
@@ skipping 221 matching lines @@
 
     SECITEM_FROM_NSSITEM(&secDER, der);
 
     /* nss3 call uses nss3 arena's */
     arena = PORT_NewArena(256);
     if (!arena) {
         return NULL;
     }
     secrv = CERT_KeyFromDERCert(arena, &secDER, &secKey);
     if (secrv != SECSuccess) {
+        PORT_FreeArena(arena, PR_FALSE);
         return NULL;
     }
     rvKey = nssItem_Create(arenaOpt, NULL, secKey.len, (void *)secKey.data);
     PORT_FreeArena(arena,PR_FALSE);
     return rvKey;
 }
 
 NSS_IMPLEMENT PRStatus
 nssPKIX509_GetIssuerAndSerialFromDER(NSSDER *der,
                                      NSSDER *issuer, NSSDER *serial)
@@ skipping 1013 matching lines @@
 **
 ** This function has the side effect of moving the
 ** surviving entries to the front of the object list
 ** and nullifying the rest.
 */
 static PRStatus
 DeleteCertTrustMatchingSlot(PK11SlotInfo *pk11slot, nssPKIObject *tObject)
 {
     int numNotDestroyed = 0;     /* the ones skipped plus the failures */
     int failureCount = 0;        /* actual deletion failures by devices */
-    int index;
+    unsigned int index;
 
     nssPKIObject_AddRef(tObject);
     nssPKIObject_Lock(tObject);
     /* Keep going even if a module fails to delete. */
     for (index = 0; index < tObject->numInstances; index++) {
         nssCryptokiObject *instance = tObject->instances[index];
         if (!instance) {
             continue;
         }
 
@@ skipping 34 matching lines @@
 NSS_EXTERN PRStatus
 STAN_DeleteCertTrustMatchingSlot(NSSCertificate *c)
 {
     PRStatus nssrv = PR_SUCCESS;
 
     NSSTrustDomain *td = STAN_GetDefaultTrustDomain();
     NSSTrust *nssTrust = nssTrustDomain_FindTrustForCertificate(td, c);
     /* caller made sure nssTrust isn't NULL */
     nssPKIObject *tobject = &nssTrust->object;
     nssPKIObject *cobject = &c->object;
-    int i;
+    unsigned int i;
 
     /* Iterate through the cert and trust object instances looking for
      * those with matching pk11 slots to delete. Even if some device
      * can't delete we keep going. Keeping a status variable for the
      * loop so that once it's failed the other gets set.
      */
     NSSRWLock_LockRead(td->tokensLock);
     nssPKIObject_AddRef(cobject);
     nssPKIObject_Lock(cobject);
     for (i = 0; i < cobject->numInstances; i++) {
@@ skipping 89 matching lines @@
     td = STAN_GetDefaultTrustDomain();
     cc = STAN_GetDefaultCryptoContext();
     printf("\n\nCertificates in the cache:\n");
     nssTrustDomain_DumpCacheInfo(td, cert_dump_iter, NULL);
     printf("\n\nCertificates in the temporary store:\n");
     if (cc->certStore) {
         nssCertificateStore_DumpStoreInfo(cc->certStore, cert_dump_iter, NULL);
     }
 }