128915 - Crash when importing recipient s/mime cert.

Status: VERIFIED FIXED

(NSS :: Libraries, defect, P1)

Description

[Stephane Saux]

Create a new profile.
Go to pb.mcom.com
click on the cert icon for a user, click again.

Crash.

Stack trace:

CERT_SaveSMimeProfile(CERTCertificateStr * 0x014e0708, SECItemStr * 0x00000000,
SECItemStr * 0x00000000) line 709 + 6 bytes
nsNSSCertificateDB::ImportEmailCertificate(nsNSSCertificateDB * const
0x047dce30, char * 0x0452eca0, unsigned int 0x00000301, nsIInterfaceRequestor *
0x042bfb20) line 3083 + 13 bytes
PSMContentDownloader::OnStopRequest(PSMContentDownloader * const 0x0454f438,
nsIRequest * 0x046885d0, nsISupports * 0x00000000, unsigned int 0x00000000) line
1718 + 46 bytes
nsDocumentOpenInfo::OnStopRequest(nsDocumentOpenInfo * const 0x04773ce0,
nsIRequest * 0x046885d0, nsISupports * 0x00000000, unsigned int 0x00000000) line 254
nsStreamListenerTee::OnStopRequest(nsStreamListenerTee * const 0x0487f630,
nsIRequest * 0x046885d0, nsISupports * 0x00000000, unsigned int 0x00000000) line 25
nsHttpChannel::OnStopRequest(nsHttpChannel * const 0x046885d4, nsIRequest *
0x0454ef3c, nsISupports * 0x00000000, unsigned int 0x00000000) line 2513
nsOnStopRequestEvent::HandleEvent() line 213
nsARequestObserverEvent::HandlePLEvent(PLEvent * 0x042bf794) line 116
PL_HandleEvent(PLEvent * 0x042bf794) line 590 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x0108bb88) line 520 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x001c02a0 _mbsncmp(const unsigned char *, const
unsigned char *, unsigned int), unsigned int 0x0000c122, unsigned int
0x00000000, long 0x0108bb88) line 1071 + 9 bytes
USER32! 77e12e98()
USER32! 77e130e0()
USER32! 77e15824()
nsAppShellService::Run(nsAppShellService * const 0x014ea840) line 309
main1(int 0x00000001, char * * 0x00305eb0, nsISupports * 0x00000000) line 1289 +
32 bytes
main(int 0x00000001, char * * 0x00305eb0) line 1637 + 37 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 77e97d08()

Crashes on the SECITEM_FROM_NSSITEM line:

  c = STAN_GetNSSCertificate(cert);
    if (!c) return SECFailure;
    cc = c->object.cryptoContext;
    if (cc != NULL) {
	stanProfile = nssCryptoContext_FindSMIMEProfileForCertificate(cc, c);
	if (stanProfile) {
	    SECITEM_FROM_NSSITEM(&oldprof, stanProfile->profileData);
	    oldProfile = &oldprof;
	}
    } else {
	oldProfile = PK11_FindSMimeProfile(&slot, emailAddr, &cert->derSubject, 
							&oldProfileTime); 
    }

    saveit = PR_FALSE;


The stanProfile->profileData is null.

Comment 1

[Stephane Saux]

*** Bug 128911 has been marked as a duplicate of this bug. ***

Comment 2

[Stephane Saux]

Note that after the first crash, restarting on this profile and importing the
cert again doesn't cause the crash anymore. On the other hand, the user cert
doesn't appear on the "other's" tab.

Comment 3

[Robert Relyea]

I'm running with the several patches from bug 125808 and I was able to
successfully import ssaux and javi 's user certs from the directory.

The user certs are all appearing in the 'others' tab.

Comment 4

[Ian McGreer]

Attachment: prevent some crashin'

Checking this in.  Will avoid frivolous storage of empty S/MIME profiles for
temp certs, and not crash should there be some.

Comment 5

[Wan-Teh Chang]

Comment on attachment 72488 [details] [diff] [review]
prevent some crashin'

r=wtc.

Ian, later in the same function (CERT_SaveSMimeProfile), we have
    if (saveit) {
	if (cc) {
	    if (stanProfile) {
		/* well, it's hashed and in an arena, might as well just
		 * overwrite the buffer
		 */
		NSSITEM_FROM_SECITEM(stanProfile->profileTime, profileTime);
		NSSITEM_FROM_SECITEM(stanProfile->profileData, emailProfile);

Should we also change the innermost 'if' to
	    if (stanProfile && stanProfile->profileData) {
?

Comment 6

[Wan-Teh Chang]

Attachment: Only allow temporaty certs to have S/MIME profiles if the profile data exists

The first change in the previous patch is not necessary
because of the second change, so I replaced the first
change by an assertion.

Comment 7

[Wan-Teh Chang]

This is an NSS bug.  Assigned the bug to Ian.

Comment 8

[Wan-Teh Chang]

Assigned the bug to wtc.

Comment 9

[Wan-Teh Chang]

Stephane, Antonio,

I checked in Ian's fix for this crash in the NSS_CLIENT_TAG
yesterday morning.  Could you try today's Mozilla daily
build and see if it fixes the crash?

Thanks.

Comment 10

[Antonio Lam]

Tried with today's build (2002-03-06-06-trunk) on Win2000.  
I don't see the crash anymore, and the user cert showed up in the "Other" tab.

Comment 11

[Wan-Teh Chang]

Thank you, Antonio.

With Antonio's verification, I'm marking this bug fixed.

Comment 12

[John Unruh]

Verified no crash