Update NSPR to 4.12 and NSS to 3.23 on iOS

nss/lib/pk11wrap/pk11obj.c

 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 /*
  * This file manages object type indepentent functions.
  */
 #include "seccomon.h"
 #include "secmod.h"
 #include "secmodi.h"
 #include "secmodti.h"
 #include "pkcs11.h"
 #include "pkcs11t.h"
 #include "pk11func.h"
 #include "key.h" 
 #include "secitem.h"
 #include "secerr.h"
 #include "sslerr.h"
 
 #define PK11_SEARCH_CHUNKSIZE 10
 
 /*
  * Build a block big enough to hold the data
  */
 SECItem *
 PK11_BlockData(SECItem *data,unsigned long size) {
     SECItem *newData;
 
+    if (size == 0u) return NULL;
+
     newData = (SECItem *)PORT_Alloc(sizeof(SECItem));
     if (newData == NULL) return NULL;
 
     newData->len = (data->len + (size-1))/size;
     newData->len *= size;
 
     newData->data = (unsigned char *) PORT_ZAlloc(newData->len); 
     if (newData->data == NULL) {
         PORT_Free(newData);
         return NULL;
@@ skipping 621 matching lines @@
     return SECSuccess;
 }
 
 /*
  * verify a signature from its hash.
  */
 SECStatus
 PK11_Verify(SECKEYPublicKey *key, const SECItem *sig, const SECItem *hash,
             void *wincx)
 {
+    CK_MECHANISM_TYPE mech = PK11_MapSignKeyType(key->keyType);
+    return PK11_VerifyWithMechanism(key, mech, NULL, sig, hash, wincx);
+}
+
+/*
+ * Verify a signature from its hash using the given algorithm.
+ */
+SECStatus
+PK11_VerifyWithMechanism(SECKEYPublicKey *key, CK_MECHANISM_TYPE mechanism,
+                         const SECItem *param, const SECItem *sig,
+                         const SECItem *hash, void *wincx)
+{
     PK11SlotInfo *slot = key->pkcs11Slot;
     CK_OBJECT_HANDLE id = key->pkcs11ID;
     CK_MECHANISM mech = {0, NULL, 0 };
     PRBool owner = PR_TRUE;
     CK_SESSION_HANDLE session;
     CK_RV crv;
 
-    mech.mechanism = PK11_MapSignKeyType(key->keyType);
+    mech.mechanism = mechanism;
+    if (param) {
+        mech.pParameter = param->data;
+        mech.ulParameterLen = param->len;
+    }
 
     if (slot == NULL) {
         unsigned int length =  0;
         if ((mech.mechanism == CKM_DSA) && 
                                 /* 129 is 1024 bits translated to bytes and
                                  * padded with an optional '0' to maintain a
                                  * positive sign */
                                 (key->u.dsa.params.prime.len > 129)) {
             /* we need to get a slot that not only can do DSA, but can do DSA2
              * key lengths */
@@ skipping 43 matching lines @@
     }
     return SECSuccess;
 }
 
 /*
  * sign a hash. The algorithm is determined by the key.
  */
 SECStatus
 PK11_Sign(SECKEYPrivateKey *key, SECItem *sig, const SECItem *hash)
 {
+    CK_MECHANISM_TYPE mech = PK11_MapSignKeyType(key->keyType);
+    return PK11_SignWithMechanism(key, mech, NULL, sig, hash);
+}
+
+/*
+ * Sign a hash using the given algorithm.
+ */
+SECStatus
+PK11_SignWithMechanism(SECKEYPrivateKey *key, CK_MECHANISM_TYPE mechanism,
+                       const SECItem *param, SECItem *sig, const SECItem *hash)
+{
     PK11SlotInfo *slot = key->pkcs11Slot;
     CK_MECHANISM mech = {0, NULL, 0 };
     PRBool owner = PR_TRUE;
     CK_SESSION_HANDLE session;
     PRBool haslock = PR_FALSE;
     CK_ULONG len;
     CK_RV crv;
 
-    mech.mechanism = PK11_MapSignKeyType(key->keyType);
+    mech.mechanism = mechanism;
+    if (param) {
+        mech.pParameter = param->data;
+        mech.ulParameterLen = param->len;
+    }
 
     if (SECKEY_HAS_ATTRIBUTE_SET(key,CKA_PRIVATE)) {
         PK11_HandlePasswordCheck(slot, key->wincx);
     }
 
     session = pk11_GetNewSession(slot,&owner);
     haslock = (!owner || !(slot->isThreadSafe));
     if (haslock) PK11_EnterSlotMonitor(slot);
     crv = PK11_GETTAB(slot)->C_SignInit(session,&mech,key->pkcs11ID);
     if (crv != CKR_OK) {
@@ skipping 1254 matching lines @@
         PORT_SetError( PK11_MapError(crv) );
         return NULL;
     }
 
     item->data = (unsigned char*) theTemplate[0].pValue;
     item->len =theTemplate[0].ulValueLen;
 
     return item;
 }