303165 - smime: NSSCMSKeyAgreeRecipientInfoTemplate template does not match the struct NSSCMSKeyAgreeRecipientInfoStr

Status: NEW

(NSS :: Libraries, defect, P2)

Description

[Alexei Volkov]

One more case of template missmatch in smime library. Here we have ukm
as a pointer to a SECItem, where according to template

    { SEC_ASN1_OPTIONAL | SEC_ASN1_CONSTRUCTED | SEC_ASN1_EXPLICIT |
      SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_XTRN | 1,
	  offsetof(NSSCMSKeyAgreeRecipientInfo,ukm),
	  SEC_ASN1_SUB(SEC_OctetStringTemplate) },

is suppose to be a SECItem - a member of the structure.


nss/lib/smime/cmst.h:380 :

struct NSSCMSKeyAgreeRecipientInfoStr {
    SECItem				version;
    NSSCMSOriginatorIdentifierOrKey	originatorIdentifierOrKey;
    SECItem *				ukm;				/* optional */
    SECAlgorithmID			keyEncAlg;
    NSSCMSRecipientEncryptedKey **	recipientEncryptedKeys;
};
typedef struct NSSCMSKeyAgreeRecipientInfoStr NSSCMSKeyAgreeRecipientInfo;

nss/lib/smime/cmsasn1.c:372: 
const SEC_ASN1Template NSSCMSKeyAgreeRecipientInfoTemplate[] = {
    { SEC_ASN1_SEQUENCE,
	  0, NULL, sizeof(NSSCMSKeyAgreeRecipientInfo) },
    { SEC_ASN1_INTEGER,
	  offsetof(NSSCMSKeyAgreeRecipientInfo,version) },
    { SEC_ASN1_EXPLICIT | SEC_ASN1_CONSTRUCTED | SEC_ASN1_CONTEXT_SPECIFIC | 0,
	  offsetof(NSSCMSKeyAgreeRecipientInfo,originatorIdentifierOrKey),
	  NSSCMSOriginatorIdentifierOrKeyTemplate },
    { SEC_ASN1_OPTIONAL | SEC_ASN1_CONSTRUCTED | SEC_ASN1_EXPLICIT |
      SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_XTRN | 1,
	  offsetof(NSSCMSKeyAgreeRecipientInfo,ukm),
	  SEC_ASN1_SUB(SEC_OctetStringTemplate) },
    { SEC_ASN1_INLINE | SEC_ASN1_XTRN,
	  offsetof(NSSCMSKeyAgreeRecipientInfo,keyEncAlg),
	  SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate) },
    { SEC_ASN1_SEQUENCE_OF,
	  offsetof(NSSCMSKeyAgreeRecipientInfo,recipientEncryptedKeys),
	  NSSCMSRecipientEncryptedKeyTemplate },
    { 0 }
};

Comment 1

[Nelson Bolyard (seldom reads bugmail)]

Adding Bob to ASN.1 encoder/decoder related bugs

Comment 2

[Alexei Volkov]

assigning target relase

Comment 3

[Alexei Volkov]

NSS_CMSRecipientInfo_Encode can be used to exploit the problem. See bug 192590.

Comment 4

[Nelson Bolyard (seldom reads bugmail)]

Unsetting target milestone in unresolved bugs whose targets have passed.

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

The bug assignee is inactive on Bugzilla, and this bug has priority 'P2'.
:beurdouche, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 6

[Marco Castelluccio [:marco]]

We have modified the bot to only consider P1 as high priority, so I'm cancelling the needinfo here.