2072389 - SECKEY_ConvertToPublicKey leaves a SECItem::type field uninitialized for EC keys

Status: RESOLVED FIXED

(NSS :: Libraries, defect, P2)

Description

[John Schanck [:jschanck]]

In SECKEY_ConvertToPublicKey's ecKey path (lib/cryptohi/seckey.c):

  SECItem decodedPoint;                                  /* ~line 1861: uninitialized */
  ...
  rv = SEC_QuickDERDecodeItem(arena, &decodedPoint,
                              SEC_ASN1_GET(SEC_OctetStringTemplate), point);
  if (rv == SECSuccess) {
      *point = decodedPoint;                             /* copies garbage .type */
  }

NSS rarely inspects the type field of a SECItem, but nss-rs asserts that it is equal to siBuffer. This caused confusing intermittent failures in https://github.com/mozilla/nss-rs/pull/233.

Comment 1

[John Schanck [:jschanck]]

Attachment: Bug 2072389 - fix uninitialized SECItem.type in SECKEY_ConvertToPublicKey. r=#nss-reviewers

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/projects/nss/rev/2a3747c91508
fix uninitialized SECItem.type in SECKEY_ConvertToPublicKey. r=nss-reviewers,keeler