1893752 - Use of uninitialized variables on error in ckcapi_getContainer()

Status: RESOLVED FIXED

(NSS :: Libraries, defect, P3)

Description

[mozillabugs]

ckcapi_getContainer() (nss/lib/ckfw/capi/cobject.c) will use uninitialized variables if UuidCreate() (line 1865) and/or UuidToString() (line 1866) fail.

UuidCreate() can fail if the machine lacks a usable ethernet address (https://learn.microsoft.com/en-us/windows/win32/api/rpcdce/nf-rpcdce-uuidcreate ) , as could happen if the ethernet adapter falls offline for some reason. UuidToString() can fail on OOM of some private pool inside Windows, since you must free its result with RpcStringFree() (https://learn.microsoft.com/en-us/windows/win32/api/rpcdce/nf-rpcdce-uuidtostring ).

These bugs appear latent in Firefox, as this function isn't built into FF v124.0.2. Presumably it can affect other code using NSS.

From FIREFOX_124_0_2_RELEASE:

1855: static char *
1856: ckcapi_getContainer(
1857:     CK_RV *pError,
1858:     NSSItem *id)
1859: {
1860:     RPC_STATUS rstat;
1861:     UUID uuid;
1862:     char *uuidStr;
1863:     char *container;
1864: 
1865:     rstat = UuidCreate(&uuid);
1866:     rstat = UuidToString(&uuid, &uuidStr);
1867: 
1868:     /* convert it from rcp memory to our own */
1869:     container = nssUTF8_Duplicate(uuidStr, NULL);
1870:     RpcStringFree(&uuidStr);
1871: 
1872:     return container;
1873: }

Comment 1

[John Schanck [:jschanck]]

Attachment: Bug 1893752 - remove ckcapi. r=#nss-reviewers

Comment 2

[John Schanck [:jschanck]]

I suspect that no one has built this code since 2009 (Bug 494302). Let's just delete it.

Comment 3

[John Schanck [:jschanck]]

https://hg.mozilla.org/projects/nss/rev/28ae642aa5377f015976a26c55774ad12f07fc52