133415 - Crash in cert manager when switching fips mode.

Status: VERIFIED WORKSFORME

(NSS :: Libraries, defect, P1)

Description

[Stephane Saux]

To reproduce:
Create a new profile.
Import a certificates (e.g., sectest) from p12.
You now have the certmanager window opened, showing the certificates you imported.
Hide this window (e.g., with the prefs window).
Open device manager.
Switch to fips mode.
click on the certmanager window (this will bring it to the front, and it will
redraw, going to the db in the process).
crash.

talkback id:
4472076

Comment 1

[Stephane Saux]

From the debugger:

PK11_ReferenceSlot(PK11SlotInfoStr * 0xcdcdcdcd) line 459 + 3 bytes
PK11_GetInternalKeySlot() line 2206 + 43 bytes
PK11_IsLoggedIn(PK11SlotInfoStr * 0x053cb0b0, void * 0x00000000) line 2237 + 5 bytes
PK11_GetAllTokens(unsigned long 0x00000001, int 0x00000000, int 0x00000001, void
* 0x00000000) line 2404 + 22 bytes
PK11_GetBestSlotMultiple(unsigned long * 0x0012d950, int 0x00000001, void *
0x00000000) line 2473 + 19 bytes
PK11_GetBestSlot(unsigned long 0x00000001, void * 0x00000000) line 2529 + 15 bytes
PK11_VerifyRecover(SECKEYPublicKeyStr * 0x054590c8, SECItemStr * 0x0012da24,
SECItemStr * 0x0012d998, void * 0x00000000) line 3004 + 13 bytes
DecryptSigBlock(int * 0x0012d9d8, unsigned char * 0x05457804, SECKEYPublicKeyStr
* 0x054590c8, SECItemStr * 0x0012da24, char * 0x00000000) line 75 + 21 bytes
VFY_CreateContext(SECKEYPublicKeyStr * 0x054590c8, SECItemStr * 0x0012da24, int
0x00000013, void * 0x00000000) line 223 + 28 bytes
VFY_VerifyData(unsigned char * 0x053a8958, int 0x000002f7, SECKEYPublicKeyStr *
0x054590c8, SECItemStr * 0x0012da24, int 0x00000013, void * 0x00000000) line 435
+ 21 bytes
CERT_VerifySignedData(CERTSignedDataStr * 0x053a6f7c, CERTCertificateStr *
0x044fdf68, __int64 0x00039d0f3fccd230, void * 0x00000000) line 123 + 35 bytes
CERT_VerifyCertChain(NSSTrustDomainStr * 0x043e6100, CERTCertificateStr *
0x053a6f70, int 0x00000001, int 0x00000000, __int64 0x00039d0f3fccd230, void *
0x00000000, CERTVerifyLogStr * 0x00000000) line 712 + 28 bytes
CERT_VerifyCert(NSSTrustDomainStr * 0x043e6100, CERTCertificateStr * 0x053a6f70,
int 0x00000001, int 0x00000000, __int64 0x00039d0f3fccd230, void * 0x00000000,
CERTVerifyLogStr * 0x00000000) line 1138 + 37 bytes
CERT_VerifyCertNow(NSSTrustDomainStr * 0x043e6100, CERTCertificateStr *
0x053a6f70, int 0x00000001, int 0x00000000, void * 0x00000000) line 1179 + 35 bytes
nsNSSCertificate::GetUsageArray(char * 0x050a05f0, unsigned int * 0x0012e920,
unsigned int * 0x0012e554, unsigned short * * 0x0012e560) line 1407 + 25 bytes
nsNSSCertificate::GetPurposes(nsNSSCertificate * const 0x044f7570, unsigned int
* 0x0012e920, unsigned short * * 0x00000000) line 2053 + 33 bytes

In PK11_GetInternalKeySlot() we have
mod->slots[1] which is garbage.

/* get the internal key slot. FIPS has only one slot for both key slots and
 * default slots */
PK11SlotInfo *
PK11_GetInternalKeySlot(void)
{
    SECMODModule *mod = SECMOD_GetInternalModule();
    PORT_Assert(mod != NULL);
    if (!mod) {
	PORT_SetError( SEC_ERROR_NO_MODULE );
	return NULL;
    }
    return PK11_ReferenceSlot(mod->isFIPS ? mod->slots[0] : mod->slots[1]);
}

Comment 2

[Ian McGreer]

This must be a regression.  The bug existed a long time ago, and it was fixed a
long time ago.  What changes have been made to the module loading code?

Comment 3

[Wan-Teh Chang]

Assigned the bug to Bob.

The tip of the Mozilla client is using NSS 3.4 RC1 right now.

Comment 4

[Wan-Teh Chang]

Changed the QA contact to Bishakha.

Comment 5

[Wan-Teh Chang]

John, could you try to reproduce this bug with either
Mozilla 1.0 RC2 or Netscape/7.0b1?  I am just wondering
if this bug is actually a duplicate of bug 142659 that
Bob recently fixed.

Thanks.

Comment 6

[John Unruh]

I still get a crash in nss3.dll with this build.
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.0rc2) Gecko/20020510
http://climate/reports/SingleIncidentInfo.cfm?dynamicBBID=6355771

Comment 7

[Robert Relyea]

This fixes for this bug wouldn't show up in a daily build before 0515 or 0516,
and I don't believe is in the branch.

bob

Comment 8

[Robert Relyea]

John, are you still seeing a crash? I don't with my builds, but I'm using tip NSS.

bob

Comment 9

[John Unruh]

Works for me with the 6/6 branch build - no crash.

Comment 10

[John Unruh]

Verified. Following the original steps exactly, I do not see a crash.