Uprev NSS (in libssl) to NSS 3.21

net/third_party/nss/ssl/sslauth.c

 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 #include "cert.h"
 #include "secitem.h"
 #include "ssl.h"
 #include "sslimpl.h"
 #include "sslproto.h"
 #include "pk11func.h"
 #include "ocsp.h"
@@ skipping 286 matching lines @@
 
     handle = (CERTCertDBHandle *)arg;
     certStatusArray = &ss->sec.ci.sid->peerCertStatus;
 
     if (certStatusArray->len) {
         PORT_SetError(0);
         if (CERT_CacheOCSPResponseFromSideChannel(handle, ss->sec.peerCert, now,
                                                   &certStatusArray->items[0],
                                                   ss->pkcs11PinArg)
                 != SECSuccess) {
-            PRErrorCode error = PR_GetError();
-            PORT_Assert(error != 0);
+            PORT_Assert(PR_GetError() != 0);
         }
     }
 
     /* this may seem backwards, but isn't. */
     certUsage = isServer ? certUsageSSLClient : certUsageSSLServer;
 
     rv = CERT_VerifyCert(handle, ss->sec.peerCert, checkSig, certUsage,
                          now, ss->pkcs11PinArg, NULL);
 
     if ( rv != SECSuccess || isServer )
         return rv;
   
     /* cert is OK.  This is the client side of an SSL connection.
      * Now check the name field in the cert against the desired hostname.
      * NB: This is our only defense against Man-In-The-Middle (MITM) attacks!
      */
     hostname = ss->url;
     if (hostname && hostname[0])
         rv = CERT_VerifyCertName(ss->sec.peerCert, hostname);
     else 
         rv = SECFailure;
     if (rv != SECSuccess)
         PORT_SetError(SSL_ERROR_BAD_CERT_DOMAIN);
 
     return rv;
 }