1046221 - nsCryptoHMAC and nsCryptoHash do not properly guard against NSS shutdown

Status: RESOLVED FIXED

(Core :: Security: PSM, defect)

Description

[Dana Keeler (she/her) [:keeler]]

nsCryptoHash.cpp is full of things like this:

60 NS_IMETHODIMP 
61 nsCryptoHash::Init(uint32_t algorithm)
62 {
63   nsNSSShutDownPreventionLock locker;
64 
65   HASH_HashType hashType = (HASH_HashType)algorithm;

Note that while the shutdown prevention lock has been acquired, the implementation doesn't actually check if NSS has already been shut down, which to my understanding is incorrect.
Something like this needs to be added after the lock in each publicly exposed function:

if (isAlreadyShutDown()) {
  return NS_ERROR_NOT_AVAILABLE;
}

Comment 1

[Dana Keeler (she/her) [:keeler]]

Attachment: patch

Comment 2

[Dana Keeler (she/her) [:keeler]]

Thanks. https://hg.mozilla.org/integration/mozilla-inbound/rev/1c6bec021eae

Comment 3

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/1c6bec021eae