339915 - Coverity 874, NULL cert ptr crash in NSS_CMSRecipientInfo_WrapBulkKey

Status: RESOLVED FIXED

(NSS :: Libraries, defect, P2)

Description

[Nelson Bolyard (seldom reads bugmail)]

Coverity CID 874.

In NSS_CMSRecipientInfo_WrapBulkKey, if cert is NULL and certalgtag 
is any of these 3 values:
   SEC_OID_MISSI_KEA_DSS_OLD:
   SEC_OID_MISSI_KEA_DSS:
   SEC_OID_MISSI_KEA:
then we call NSS_CMSUtil_EncryptSymKey_MISSI will that null cert ptr
and that function derereferences it.  

I think this should never happen, but I see no code that ensures 
that it won't.

We could fix this by removing the MISSI cases from this switch, 
or by adding code to detect a null cert ptr.  Bob, what do you suggest?

Comment 1

[Nelson Bolyard (seldom reads bugmail)]

Attachment: Remove all MISSI cases from this source file

Bob, if you think this is the wrong approach, please write another patch
that takes the right one.

Comment 2

[Robert Relyea]

Comment on attachment 224831 [details] [diff] [review]
Remove all MISSI cases from this source file

r+

MISSI code will fail at some point because it requires FORTEZZA, but it is possible to have an old fortezza encrypted message in your mail, so it's possible that you may hit this code.

bob

Comment 3

[Julien Pierre]

Retargetting all P2s to 3.11.3 .

Comment 4

[Nelson Bolyard (seldom reads bugmail)]

Remove FORTEZZA code from this file.  Coverity CID 874. r=rrelyea.

Checking in cmsrecinfo.c; new revision: 1.19;     previous revision: 1.18
Checking in cmsrecinfo.c; new revision: 1.16.2.2; previous revision: 1.16.2.1

Resolved / Fixed