1348767 - logical rather than bitwise OR operator used in OCSP requests

Status: RESOLVED FIXED

(NSS :: Libraries, defect)

Description

[Petr Cerny [:hrosik]]

Attachment: use bitwise OR instead of logical in OCSP requests

Richard Biener of the SUSE compiler team noticed a warning while testing GCC7, which pointed to NSS incorrectly using logical OR operator instead of the bitwise version in the OCSP requests code.

Patch against NSS trunk attached

CC: Marcus Meissner from the SUSE Security Team, who also reported this issue via email to <[e-mail]>.

Comment 1

[Franziskus Kiefer [:franziskus]]

Comment on attachment 8849033 [details] [diff] [review]
use bitwise OR instead of logical in OCSP requests

Review of attachment 8849033 [details] [diff] [review]:
-----------------------------------------------------------------

Thanks for the patch!

Comment 2

[Franziskus Kiefer [:franziskus]]

https://hg.mozilla.org/projects/nss/rev/0dca14409fefa9090db2a382d2dbfdc6d800852e

Comment 3

[Ryan VanderMeulen [:RyanVM]]

What's the severity of this? Do we need to consider backporting this to stable branches?

Comment 4

[Franziskus Kiefer [:franziskus]]

The issue is in libpkix, which isn't used by Firefox (and really shouldn't be used by anyone at this point). So no backporting necessary.

Comment 5

[Kai Engert (:KaiE:)]

(In reply to Franziskus Kiefer [:fkiefer or :franziskus] from comment #4)
> The issue is in libpkix, which isn't used by Firefox (and really shouldn't
> be used by anyone at this point). So no backporting necessary.

Other applications might still use it.

Comment 6

[Kai Engert (:KaiE:)]

It seems this hash isn't used as part of the hash request that's sent out to the network.

If I'm reading the code correctly, this hash is simply used for an internal HashTable, so the function currently is using worse hashes than the code was trying to. If correct, then the only effect might be slowdown, as linear searches in that HashTable would occurr frequently.