308405 - "@mozilla.org/security/hash;1" incorrectly invoked as a service in nsHttpDigestAuth.cpp

Status: RESOLVED FIXED

(Core :: Networking: HTTP, defect)

Description

[Charles Melhorn]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b4) Gecko/20050908 Firefox/1.4
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b4) Gecko/20050908 Firefox/1.4

Per Doug Turner, the CryptoHash component ("@mozilla.org/security/hash;1")
should not be used as a service, as it appears to be in nsHttpDigestAuth.cpp:

http://lxr.mozilla.org/seamonkey/source/netwerk/protocol/http/src/nsHttpDigestAuth.cpp#66


Reproducible: Always

Comment 1

[Darin Fisher]

Attachment: v1 patch

Comment 2

[Doug Turner (:dougt)]

Comment on attachment 195993 [details] [diff] [review]
v1 patch

+    mVerifier = do_CreateInstance("@mozilla.org/security/hash;1");
+    if (NS_FAILED(rv)) {

Test against |mVerifier|.  rv isn't used or needed.

+  NS_ENSURE_STATE(hashString.Length() == sizeof(mHashBuf));

I am not sure why you need to do this.

Comment 3

[Darin Fisher]

(In reply to comment #2)
> (From update of attachment 195993 [details] [diff] [review] [edit])
> +    mVerifier = do_CreateInstance("@mozilla.org/security/hash;1");
> +    if (NS_FAILED(rv)) {
> 
> Test against |mVerifier|.  rv isn't used or needed.

whoops, i meant to catch rv from do_CreateInstance.  I'd rather propogate that
failure code instead of inventing one.



> +  NS_ENSURE_STATE(hashString.Length() == sizeof(mHashBuf));
> 
> I am not sure why you need to do this.

Defense in depth.  It would be very unfortunate if hashString.Length() were ever
greater than sizeof(mHashBuf).

Comment 4

[Darin Fisher]

Attachment: v1.1 patch

Comment 5

[Darin Fisher]

fixed-on-trunk