113741 - CERT_FindCertByUsage crashes

Status: RESOLVED FIXED

(NSS :: Libraries, defect, P1)

Description

[Julien Pierre]

1. apply my patch from
http://bugzilla.mozilla.org/attachment.cgi?id=59978&action=view which makes
cmsutil to use CERT_FindCertByUsage instead of CERT_FindCertByNickname (bug
http://bugzilla.mozilla.org/show_bug.cgi?id=108097 ) to a fresh 3.4 tree.
2. send a signed email with smime.pl using an old (single-key) cert. I used my
own old Netscape personal cert that expired last week (had to set my Sun machine
date in the past a bit to do it :))

3. crash occurs. The stack is

current thread: t@1
=>[1] SECITEM_Hash(key = 0x87488), line 262 in "secitem.c"
  [2] PL_HashTableLookup(ht = 0x588a8, key = 0x87488), line 387 in "plhash.c"
  [3] SECOID_FindOID(oid = 0x87488), line 1235 in "secoid.c"
  [4] seckey_UpdateCertPQGChain(subjectCert = 0x873b0, count = 1), line 378 in
"seckey.c"
  [5] SECKEY_UpdateCertPQG(subjectCert = 0x873b0), line 479 in "seckey.c"
  [6] CERT_ExtractPublicKey(cert = 0x873b0), line 965 in "seckey.c"
  [7] CERT_CheckKeyUsage(cert = 0x873b0, requiredUsage = 16384U), line 1137 in
"certdb.c"
  [8] CERT_FilterCertListByUsage(certList = 0x9ecc8, usage =
certUsageEmailRecipient, ca = 0), line 2232 in "certdb.c"
  [9] CERT_FindUserCertByUsage(handle = 0x5fab8, nickname = 0x59858 "Julien
Pierre's America Online Inc ID", usage = certUsageEmailRecipient, validOnly = 0,
proto_win = (nil)), line 254 in "certhigh.c"
  [10] signed_data(signOptions = 0xffbef9ec), line 536 in "cmsutil.c"
  [11] main(argc = 12, argv = 0xffbefaa4), line 1254 in "cmsutil.c"
(dbx)

Comment 1

[Julien Pierre]

FYI, the exact test case I used is :

cat signed.txt | smime -d . -p "xxx" -S "Julien Pierre's America Online In
c ID"

When I do this in an NSS 3.3 tree, everything works fine. This is an NSS 3.4
regression.

Comment 2

[Ian McGreer]

Taking this bug.  I found the problem and am working on it.

Comment 3

[Ian McGreer]

Attachment: attaching this for reference, already checked in.

Julien/Alan:

Can you try again with this?  It's already in, just need to rebuild.  I tried
to test it using certutil but I was having a hard time getting the dual-key
certs set up correctly.  I think it will work, though, I was able to have
cmsutil locate and use the two certs separately.

Comment 4

[Ian McGreer]

Attachment: attaching this for reference, already checked in.

Julien/Alan:

Can you try again with this?  It's already in, just need to rebuild.  I tried
to test it using certutil but I was having a hard time getting the dual-key
certs set up correctly.  I think it will work, though, I was able to have
cmsutil locate and use the two certs separately.

Comment 5

[Ian McGreer]

Attachment: attaching this for reference, already checked in.

Julien/Alan:

Can you try again with this?  It's already in, just need to rebuild.  I tried
to test it using certutil but I was having a hard time getting the dual-key
certs set up correctly.  I think it will work, though, I was able to have
cmsutil locate and use the two certs separately.

Comment 6

[Ian McGreer]

Comment on attachment 60653 [details] [diff] [review]
attaching this for reference, already checked in.

sorry about that, bugzilla wasn't responding...

Comment 7

[Julien Pierre]

Ian,

Your patch does gets me past this crash, so I'm marking this bug fixed. I'm
still experiencing other crashes however - see
http://bugzilla.mozilla.org/show_bug.cgi?id=113746 .

Comment 8

[Wan-Teh Chang]

Set target milestone to NSS 3.4.