Update NSPR to 4.12 and NSS to 3.23 on iOS

nss/lib/util/secasn1d.c

 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 /*
  * Support for DEcoding ASN.1 data based on BER/DER (Basic/Distinguished
  * Encoding Rules).
  */
 
 /* #define DEBUG_ASN1D_STATES 1 */
 
 #ifdef DEBUG_ASN1D_STATES
 #include <stdio.h>
 #define PR_Assert sec_asn1d_Assert
 #endif
 
+#include <limits.h>
+
 #include "secasn1.h"
 #include "secerr.h"
 
 typedef enum {
     beforeIdentifier,
     duringIdentifier,
     afterIdentifier,
     beforeLength,
     duringLength,
     afterLength,
@@ skipping 1559 matching lines @@
         return 0;
     }
 
     if (state->pending < len)
         len = state->pending;
 
     bufLen = len;
 
     item = (SECItem *)(state->dest);
     if (item != NULL && item->data != NULL) {
+        unsigned long offset;
         /* Strip leading zeroes when target is unsigned integer */
         if (state->underlying_kind == SEC_ASN1_INTEGER && /* INTEGER   */
             item->len == 0 &&                             /* MSB       */
             item->type == siUnsignedInteger)              /* unsigned  */
         {
             while (len > 1 && buf[0] == 0) {              /* leading 0 */
                 buf++;
                 len--;
             }
         }
-        PORT_Memcpy (item->data + item->len, buf, len);
-        item->len += len;
+        offset = item->len;
+        if (state->underlying_kind == SEC_ASN1_BIT_STRING) {
+            // The previous bit string must have no unused bits.
+            if (item->len & 0x7) {
+                PORT_SetError (SEC_ERROR_BAD_DER);
+                state->top->status = decodeError;
+                return 0;
+            }
+            // If this is a bit string, the length is bits, not bytes.
+            offset = item->len >> 3;
+        }
+        if (state->underlying_kind == SEC_ASN1_BIT_STRING) {
+            unsigned long len_in_bits;
+            // Protect against overflow during the bytes-to-bits conversion.
+            if (len >= (ULONG_MAX >> 3) + 1) {
+                PORT_SetError (SEC_ERROR_BAD_DER);
+                state->top->status = decodeError;
+                return 0;
+            }
+            len_in_bits = (len << 3) - state->bit_string_unused_bits;
+            // Protect against overflow when computing the total length in bits.
+            if (UINT_MAX - item->len < len_in_bits) {
+                PORT_SetError (SEC_ERROR_BAD_DER);
+                state->top->status = decodeError;
+                return 0;
+            }
+            item->len += len_in_bits;
+        } else {
+            if (UINT_MAX - item->len < len) {
+                PORT_SetError (SEC_ERROR_BAD_DER);
+                state->top->status = decodeError;
+                return 0;
+            }
+            item->len += len;
+        }
+        PORT_Memcpy (item->data + offset, buf, len);
     }
     state->pending -= bufLen;
     if (state->pending == 0)
         state->place = beforeEndOfContents;
 
     return bufLen;
 }
 
 
 static unsigned long
@@ skipping 46 matching lines @@
             PORT_SetError (SEC_ERROR_BAD_DER);
             state->top->status = decodeError;
         } else {
             /* An empty bit string with no unused bits is OK. */
             state->place = beforeEndOfContents;
         }
         return 0;
     }
 
     len = sec_asn1d_parse_leaf (state, buf, len);
-    if (state->place == beforeEndOfContents && state->dest != NULL) {
-        SECItem *item;
-
-        item = (SECItem *)(state->dest);
-        if (item->len)
-            item->len = (item->len << 3) - state->bit_string_unused_bits;
-    }
-
     return len;
 }
 
 
 /*
  * XXX All callers should be looking at return value to detect
  * out-of-memory errors (and stop!).
  */
 static struct subitem *
 sec_asn1d_add_to_subitems (sec_asn1d_state *state,
@@ skipping 509 matching lines @@
         item_len = 0;
         is_bit_string = (state->underlying_kind == SEC_ASN1_BIT_STRING)
                         ? PR_TRUE : PR_FALSE;
 
         substring = state->subitems_head;
         while (substring != NULL) {
             /*
              * All bit-string substrings except the last one should be
              * a clean multiple of 8 bits.
              */
-            if (is_bit_string && (substring->next == NULL)
+            if (is_bit_string && (substring->next != NULL)
                               && (substring->len & 0x7)) {
                 PORT_SetError (SEC_ERROR_BAD_DER);
                 state->top->status = decodeError;
                 return;
             }
             item_len += substring->len;
             substring = substring->next;
         }
 
         if (is_bit_string) {
@@ skipping 1172 matching lines @@
 SEC_ASN1_CHOOSER_IMPLEMENT(SEC_EnumeratedTemplate)
 SEC_ASN1_CHOOSER_IMPLEMENT(SEC_PointerToEnumeratedTemplate)
 SEC_ASN1_CHOOSER_IMPLEMENT(SEC_SequenceOfAnyTemplate)
 SEC_ASN1_CHOOSER_IMPLEMENT(SEC_SequenceOfObjectIDTemplate)
 SEC_ASN1_CHOOSER_IMPLEMENT(SEC_SkipTemplate)
 SEC_ASN1_CHOOSER_IMPLEMENT(SEC_UniversalStringTemplate)
 SEC_ASN1_CHOOSER_IMPLEMENT(SEC_PrintableStringTemplate)
 SEC_ASN1_CHOOSER_IMPLEMENT(SEC_T61StringTemplate)
 SEC_ASN1_CHOOSER_IMPLEMENT(SEC_PointerToGeneralizedTimeTemplate)