1168048 - Avoid potential null-pointer dereferencing in nsNSSCertificateDB

Status: RESOLVED FIXED

(Core :: Security: PSM, defect)

Description

[Kaspar]

Attachment: Proposed patch

When nsIX509Cert2 and nsIX509Cert3 were mreged into nsIX509Cert with bug 643041, two null-pointer checks got "lost", resulting in potential crashes (which is the reason for setting the severity to critical).

Triggering the issue from privileged chrome is straightforward (as both methods are scriptable), simply paste

Components.classes["@mozilla.org/security/x509certdb;1"].getService(Components.interfaces.nsIX509CertDB).deleteCertificate(null);

or

Components.classes["@mozilla.org/security/x509certdb;1"].getService(Components.interfaces.nsIX509CertDB).setCertTrust(null,0,0);

into the Web Console.

Comment 1

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Comment on attachment 8610010 [details] [diff] [review]
Proposed patch

Review of attachment 8610010 [details] [diff] [review]:
-----------------------------------------------------------------

Thanks - r=me.

Comment 2

[Kaspar]

Ok, so before I can set the checkin-needed keyword, I guess a tryserver build is needed. Could you submit one for me?

Comment 3

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/4ef26dba9e6f

Comment 4

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

I went ahead and pushed this. I would be quite surprised if it broke anything.

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/4ef26dba9e6f