306795 - nsIX509CertDB::IsCertTrusted() can return bogus values

Status: RESOLVED FIXED

(Core :: Security: PSM, defect, P1)

Description

[Simon Fraser [no longer active]]

I'm seeing nsIX509CertDB::IsCertTrusted() return bogus trusted values for certs
that I'm downloading (I guess I'm driving the APIs differently from Firefox).

Looking at the code, nsNSSCertificateDB::IsCertTrusted() is ignoring the return
value from CERT_GetCertTrust(), and so uninitialized bits of stack memory.

GetCertTrust() is failing because cert->trust is null.

Comment 1

[Simon Fraser [no longer active]]

This would seem to be fairly serious.

Comment 2

[Simon Fraser [no longer active]]

Attachment: Patch

Comment 3

[Scott MacGregor]

Triage team: this looks very low risk, high reward.

Comment 4

[Mike Schroepfer]

Please checkin and verify on trunk.  Then ask for approval for branch checkin.

Comment 5

[Robert Relyea]

Comment on attachment 194635 [details] [diff] [review]
Patch

Fortunately, I believe we only use this code in the UI for a Certificate
itself, but that doesn't mean it can't be set in the future. We should take
this patch into 1.85
r=relyea

Comment 6

[Simon Fraser [no longer active]]

Comment on attachment 194635 [details] [diff] [review]
Patch

Checked in on the trunk. Requesting branch approval; this is a very low-risk
fix.

Comment 7

[Simon Fraser [no longer active]]

Fixed on trunk.

Comment 8

[Simon Fraser [no longer active]]

/cvsroot/mozilla/security/manager/ssl/src/nsNSSCertificateDB.cpp,v  <-- 
nsNSSCertificateDB.cpp
new revision: 1.15.20.1; previous revision: 1.15

Fixed on branch.