ssl3_PlatformSignHashes should set buf->len to the...

net/third_party/nss/ssl/sslplatf.c

 /*
  * Platform specific crypto wrappers
  *
  * ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
  * The contents of this file are subject to the Mozilla Public License Version
  * 1.1 (the "License"); you may not use this file except in compliance with
  * the License. You may obtain a copy of the License at
  * http://www.mozilla.org/MPL/
@@ skipping 242 matching lines @@
     }
     if (!CryptSetHashParam(hHash, HP_HASHVAL, (BYTE*)hashItem.data, 0)) {
         ssl_MapLowLevelError(SSL_ERROR_SIGN_HASHES_FAILURE);
         goto done;
     }
     if (!CryptSignHash(hHash, keySpec, NULL, CRYPT_NOHASHOID,
                        NULL, &signatureLen) || signatureLen == 0) {
         ssl_MapLowLevelError(SSL_ERROR_SIGN_HASHES_FAILURE);
         goto done;
     }
-    buf->len  = signatureLen;
     buf->data = (unsigned char *)PORT_Alloc(signatureLen);
     if (!buf->data)
         goto done;    /* error code was set. */
 
     if (!CryptSignHash(hHash, keySpec, NULL, CRYPT_NOHASHOID,
                        (BYTE*)buf->data, &signatureLen)) {
         ssl_MapLowLevelError(SSL_ERROR_SIGN_HASHES_FAILURE);
         goto done;
     }
+    buf->len = signatureLen;
 
     /* CryptoAPI signs in little-endian, so reverse */
     for (i = 0; i < buf->len / 2; ++i) {
         unsigned char tmp = buf->data[i];
         buf->data[i] = buf->data[buf->len - 1 - i];
         buf->data[buf->len - 1 - i] = tmp;
     }
     if (doDerEncode) {
         SECItem   derSig = {siBuffer, NULL, 0};
 
@@ skipping 134 matching lines @@
     /* SecKeyGetBlockSize wasn't addeded until OS X 10.6 - but the
      * needed information is readily available on the key itself.
      */
     signatureLen = (cssmKey->KeyHeader.LogicalKeySizeInBits + 7) / 8;
     
     if (signatureLen == 0) {
         PORT_SetError(SEC_ERROR_INVALID_KEY);
         goto done;
     }
 
-    buf->len  = signatureLen;
     buf->data = (unsigned char *)PORT_Alloc(signatureLen);
     if (!buf->data)
         goto done;    /* error code was set. */
 
     sigAlg = cssmKey->KeyHeader.AlgorithmId;
     switch (sigAlg) {
         case CSSM_ALGID_RSA:
             hashData.Data   = hash->md5;
             hashData.Length = sizeof(SSL3Hashes);
             break;
@@ skipping 17 matching lines @@
      * you can prevent the UI by setting the provider handle on the
      * certificate to be opened with CRYPT_SILENT, but is there an equivalent?
      */
     status = SecKeyGetCredentials(key, CSSM_ACL_AUTHORIZATION_SIGN,
                                   kSecCredentialTypeDefault, &cssmCreds);
     if (status != noErr) {
         ssl_MapLowLevelError(SSL_ERROR_SIGN_HASHES_FAILURE);
         goto done;
     }
 
-    signatureData.Length = buf->len;
+    signatureData.Length = signatureLen;
     signatureData.Data   = (uint8*)buf->data;
     
     cssmRv = CSSM_CSP_CreateSignatureContext(cspHandle, sigAlg, cssmCreds,
                                              cssmKey, &cssmSignature);
     if (cssmRv) {
         ssl_MapLowLevelError(SSL_ERROR_SIGN_HASHES_FAILURE);
         goto done;
     }
 
     /* See "Apple Cryptographic Service Provider Functional Specification" */
     if (cssmKey->KeyHeader.AlgorithmId == CSSM_ALGID_RSA) {
         /* To set RSA blinding for RSA keys */
         CSSM_CONTEXT_ATTRIBUTE blindingAttr;
         blindingAttr.AttributeType   = CSSM_ATTRIBUTE_RSA_BLINDING;
         blindingAttr.AttributeLength = sizeof(uint32);
         blindingAttr.Attribute.Uint32 = 1;
         cssmRv = CSSM_UpdateContextAttributes(cssmSignature, 1, &blindingAttr);
         if (cssmRv) {
             ssl_MapLowLevelError(SSL_ERROR_SIGN_HASHES_FAILURE);
             goto done;
         }
     }
 
     cssmRv = CSSM_SignData(cssmSignature, &hashData, 1, CSSM_ALGID_NONE,
                            &signatureData);
     if (cssmRv) {
         ssl_MapLowLevelError(SSL_ERROR_SIGN_HASHES_FAILURE);
         goto done;
     }
+    buf->len = signatureData.Length;
 
     if (doDerEncode) {
         SECItem derSig = {siBuffer, NULL, 0};
 
         /* This also works for an ECDSA signature */
         rv = DSAU_EncodeDerSigWithLen(&derSig, buf, buf->len);
         if (rv == SECSuccess) {
             PORT_Free(buf->data);     /* discard unencoded signature. */
             *buf = derSig;            /* give caller encoded signature. */
         } else if (derSig.data) {
@@ skipping 47 matching lines @@
 SECStatus
 ssl3_PlatformSignHashes(SSL3Hashes *hash, PlatformKey key, SECItem *buf,
                         PRBool isTLS)
 {
     PORT_SetError(PR_NOT_IMPLEMENTED_ERROR);
     return SECFailure;
 }
 #endif
 
 #endif /* NSS_PLATFORM_CLIENT_AUTH */