Bug 1986352 Comment 0 Edit History

Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.

Original comment by
on 
OSS-Fuzz: https://oss-fuzz.com/testcase-detail/5304540506423296

### Details
The assertion was added in [a10493dcfcc92cb9bad985b151325238b6e38b09](https://hg-edge.mozilla.org/projects/nss/rev/a10493dcfcc92cb9bad985b151325238b6e38b09) as part of Bug 1654332. If `tmpEchInner` is `NULL`, it will lead to a null pointer dereference later on:
```c
        PORT_Assert(tmpEchInner);
        PORT_Assert(!PR_CLIST_IS_EMPTY(&ss->ssl3.hs.remoteExtensions));

        /* Start over on ECHInner */
        b = tmpEchInner->data;
        length = tmpEchInner->len;
        rv = ssl3_HandleClientHelloPreamble(ss, &b, &length, &tmpSid,
                                            &tmpCookie, &tmpSuites, &tmpComps);
        if (rv != SECSuccess) {
            goto loser; /* code set, alert sent. */
        }
```
Note that this was found with `UNSAFE_FUZZING_MODE` enabled.

---

To reproduce, perform the following steps:
1. Build NSS with `./build.sh -c --fuzz=tls --disable-tests`
2. Run `/path/to/dist/Debug/bin/nssfuzz-tls-server /path/to/testcase`
Revision 1 by
on 
OSS-Fuzz: https://oss-fuzz.com/testcase-detail/5304540506423296

### Details
The assertion was added in [a10493dcfcc92cb9bad985b151325238b6e38b09](https://hg-edge.mozilla.org/projects/nss/rev/a10493dcfcc92cb9bad985b151325238b6e38b09) as part of Bug 1654332. If `tmpEchInner` is `NULL`, it will lead to a null pointer dereference later on:
```c
        PORT_Assert(tmpEchInner);
        PORT_Assert(!PR_CLIST_IS_EMPTY(&ss->ssl3.hs.remoteExtensions));

        /* Start over on ECHInner */
        b = tmpEchInner->data;
        length = tmpEchInner->len;
        rv = ssl3_HandleClientHelloPreamble(ss, &b, &length, &tmpSid,
                                            &tmpCookie, &tmpSuites, &tmpComps);
        if (rv != SECSuccess) {
            goto loser; /* code set, alert sent. */
        }
```
Note that this was found with `UNSAFE_FUZZER_MODE` enabled.

---

To reproduce, perform the following steps:
1. Build NSS with `./build.sh -c --fuzz=tls --disable-tests`
2. Run `/path/to/dist/Debug/bin/nssfuzz-tls-server /path/to/testcase`

Back to Bug 1986352 Comment 0