Update NSS to 3.21 RTM and NSPR to 4.11 RTM

nss/lib/freebl/ecl/ecp_jac.c

Index: nss/lib/freebl/ecl/ecp_jac.c
diff --git a/nss/lib/freebl/ecl/ecp_jac.c b/nss/lib/freebl/ecl/ecp_jac.c
index c7bb239c993a0d4ab9f423966a61e2d6b73d2e6b..f174b1692400b603fd1705b49795e8123bf6e473 100644
--- a/nss/lib/freebl/ecl/ecp_jac.c
+++ b/nss/lib/freebl/ecl/ecp_jac.c
@@ -144,6 +144,20 @@ ec_GFp_pt_add_jac_aff(const mp_int *px, const mp_int *py, const mp_int *pz,
 	MP_CHECKOK(group->meth->field_sub(&A, px, &C, group->meth));
 	MP_CHECKOK(group->meth->field_sub(&B, py, &D, group->meth));
 
+	if (mp_cmp_z(&C) == 0) {
+		/* P == Q or P == -Q */

[Ryan Sleevi, 2015/12/11 01:26:14]

Of interest; correctness fix

[davidben, 2015/12/11 22:10:58]

I don't really know this math well enough to be able to review it or judge
impact.

https://bugzilla.mozilla.org/show_bug.cgi?id=1125025 doesn't seem to think it
affects TLS.

+		if (mp_cmp_z(&D) == 0) {
+			/* P == Q */
+			/* It is cheaper to double (qx, qy, 1) than (px, py, pz). */
+			MP_DIGIT(&D, 0) = 1; /* Set D to 1. */
+			MP_CHECKOK(ec_GFp_pt_dbl_jac(qx, qy, &D, rx, ry, rz, group));
+		} else {
+			/* P == -Q */
+			MP_CHECKOK(ec_GFp_pt_set_inf_jac(rx, ry, rz));
+		}
+		goto CLEANUP;
+	}
+
 	/* C2 = C^2, C3 = C^3 */
 	MP_CHECKOK(group->meth->field_sqr(&C, &C2, group->meth));
 	MP_CHECKOK(group->meth->field_mul(&C, &C2, &C3, group->meth));
@@ -205,7 +219,8 @@ ec_GFp_pt_dbl_jac(const mp_int *px, const mp_int *py, const mp_int *pz,
 	MP_CHECKOK(mp_init(&M));
 	MP_CHECKOK(mp_init(&S));
 
-	if (ec_GFp_pt_is_inf_jac(px, py, pz) == MP_YES) {
+	/* P == inf or P == -P */

[Ryan Sleevi, 2015/12/11 01:26:14]

Another correctness fix

[davidben, 2015/12/11 22:10:58]

Ditto.

+	if (ec_GFp_pt_is_inf_jac(px, py, pz) == MP_YES || mp_cmp_z(py) == 0) {
 		MP_CHECKOK(ec_GFp_pt_set_inf_jac(rx, ry, rz));
 		goto CLEANUP;
 	}
@@ -372,7 +387,7 @@ ec_GFp_pts_mul_jac(const mp_int *k1, const mp_int *k2, const mp_int *px,
 	mp_int precomp[4][4][2];
 	mp_int rz;
 	const mp_int *a, *b;
-	int i, j;
+	unsigned int i, j;
 	int ai, bi, d;
 
 	for (i = 0; i < 4; i++) {
@@ -479,7 +494,7 @@ ec_GFp_pts_mul_jac(const mp_int *k1, const mp_int *k2, const mp_int *px,
 	MP_CHECKOK(mp_init(&rz));
 	MP_CHECKOK(ec_GFp_pt_set_inf_jac(rx, ry, &rz));
 
-	for (i = d - 1; i >= 0; i--) {
+        for (i = d; i-- > 0;) {
 		ai = MP_GET_BIT(a, 2 * i + 1);
 		ai <<= 1;
 		ai |= MP_GET_BIT(a, 2 * i);