198307 - CERT_VerifyCertNow asserts if certUsage==AnyCA or VerifyCA

Status: NEW

(NSS :: Libraries, defect, P5)

Description

[Jamie Nicolson]

If certUsage==AnyCA, then CERT_VerifyCertNow throws:

Assertion failure: 0, at certvfy.c:1519


If certUsage==VerifyCA, then Cert_VerifyCertNow throws:
Assertion failure: 0, at certdb.c:1135

Comment 1

[Nelson Bolyard (seldom reads bugmail)]

Jamie told me that JSS has exposed CERT_VerifyCertNow and all the enumerated 
usage values that go with it.  Calling that function with some of the defined
values causes a crash in the VM, which is a no-no.  

The questions are: 
1. what do each of those usages really mean?
   (e.g. what's the difference between ObjectSigner and ProtectedObjectSigner,
    or between VerifyCA and AnyCA?), and

2. which of those usages are valid as inputs to CERT_VerifyCertNow?  and

3. are there any usages that should be valid but aren't?

Then JSS needs to disallow any usages that are defined as not valid for this
function and NSS needs to ensure that all usages that are valid for this
function don't assert.

Comment 2

[Nelson Bolyard (seldom reads bugmail)]

Taking this old bug of Ian's.
Glen,  Is this bug still important to JSS?

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

The bug assignee is inactive on Bugzilla, and this bug has priority 'P2'.
:beurdouche, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 4

[John Schanck [:jschanck]]

CERT_VerifyNow is obsolete. We'd take a patch if anyone still needs it.