101683 - free memory too much!

Status: RESOLVED DUPLICATE of bug 95458

(NSS :: Libraries, defect, P1)

Description

[liqi]

hi:
  decode certificate use SEC_ASN1DecoderUpdate ,when it fault more second 
recursion ,free memory too much,so 0xdadadadaa access error

	
you can get this error:
 export windows2000's administrator certificate and import our database

maybe modify:
SECStatus
SEC_ASN1DecoderUpdate (SEC_ASN1DecoderContext *cx,
		       const char *buf, unsigned long len)
{
    sec_asn1d_state *state = NULL;
    unsigned long consumed;
    SEC_ASN1EncodingPart what;
    sec_asn1d_state *stateEnd = cx->current;/*add codes by liqi 2001.9.26 for 
more free memory*/
    						
    
    ....
    
    	while (state != NULL&&stateEnd!=state) {/*modify codes by liqi 
2001.9.26 for more free memory*/
    						/* while (state != NULL) 
{   old code*/
	    sec_asn1d_free_child (state, PR_TRUE);
	    state = state->parent;
	}

Comment 1

[liqi]

while (state != NULL&&stateEnd->parent!=state) {

Comment 2

[Wan-Teh Chang]

Assigned the bug to Julien.  Julien, you can ask
Bob if you have questions.

Comment 3

[Keyser Sose]

Marking NEW...possible patch adding keywords. Can someone comment/review the patch?

Comment 4

[Wan-Teh Chang]

This should be reviewed.  If that code is
exercised by S/MIME, the fix should go into
NSS_3_3_BRANCH as well.

Comment 5

[Julien Pierre]

Wan-Teh,

Yes, this code has the potential to be exercised by S/MIME if improperly encoded
data is passed to the asn1 decoder.

Liqi,

I need more info about this bug. What was your test case ? Do you have a sample
certificate that is known to cause this crash ? What tool did you use to
reproduce the crash ?

Comment 6

[Julien Pierre]

Never mind, I have my own test case for this. This is actually a duplicate bug
of 95458, so I'm marking it as dupe . The fix suggested by liqi solves the crash
in SEC_ASN1DecoderUpdate. I will be adding the patch to the other bug.



*** This bug has been marked as a duplicate of 95458 ***

Comment 7

[liqi]

Attachment: 123456

> hi
>     this test.pfx as a sample,it's passward "123456"
> 
>      ok,I talk about it;
>      I do't know  whether the certificate is originally .but I can say 
> cause this crash ,then,any enter more than two times recursion ,and error
occur on this layer,must fault;
>      by way of,the sample two kinds of time decode error.
>				     your liqi

Comment 8

[Julien Pierre]

Liqi,

Please don't update this bug anymore. Please go to
http://bugzilla.mozilla.org/show_bug.cgi?id=95458 for anything related to this
problem. Thanks.