1630925 - Missing null check in NSS_CMSSignedData_GetSignerInfo for sigd->signerInfos

Status: RESOLVED FIXED

(NSS :: Libraries, defect, P1)

Description

[Frederik Braun [:freddy]]

This e-mail was sent to our dev-security mailing list, with a patch attached:

Hi , [e-mail]

I found a bug in function NSS_CMSSignedData_GetSignerInfo, sigd->signerInfos not judged !NULL before use. It cause core dump.

NSSCMSSignerInfo *
NSS_CMSSignedData_GetSignerInfo(NSSCMSSignedData *sigd, int i)
{
if (!sigd) {
PORT_SetError(SEC_ERROR_INVALID_ARGS);
return NULL;
}
return sigd->signerInfos[i];
}

Signed-off-by: zhujianwei7 <[e-mail]>

diff -uNr nss/lib/smime/cmssigdata.c nss.fix/lib/smime/cmssigdata.c
--- nss/lib/smime/cmssigdata.c  2018-12-01 06:41:31.000000000 +0800
+++ nss.fix/lib/smime/cmssigdata.c  2020-04-08 08:20:28.931050077 +0800
@@ -476,7 +476,7 @@
 NSSCMSSignerInfo *
 NSS_CMSSignedData_GetSignerInfo(NSSCMSSignedData *sigd, int i)
 {
-    if (!sigd) {
+    if (!sigd || !sigd->signerInfos) {
         PORT_SetError(SEC_ERROR_INVALID_ARGS);
         return NULL;
     }

Comment 1

[J.C. Jones [:jcj] (he/him)]

Emailed reporter to ask how they'd like to be attributed, if they would.

Comment 2

[J.C. Jones [:jcj] (he/him)]

Attachment: Bug 1630925 - Guard all instances of NSSCMSSignedData.signerInfos r=kjacobs

Comment 3

[J.C. Jones [:jcj] (he/him)]

https://hg.mozilla.org/projects/nss/rev/bb4462a16de8ca52068ca1e83351b576b60f2410