394206 - PKIX_PL_Cert_IsCertTrusted checks wrong flag

Status: RESOLVED FIXED

(NSS :: Libraries, defect)

Description

[Kai Engert (:KaiE:)]

Spun off from bug 391454 comment 9 and bug 391454 comment 19 and bug 391454 comment 22.

PKIX_PL_Cert_IsCertTrusted checks the wrong flag.
It checks CERTDB_VALID_CA, and treats any cert with that flag as trusted.

Function CERT_TrustFlagsForCACertUsage returns the required set of flags.
The correct patch for this code is:
         if (rv == SECSuccess) {

                 certFlags = SEC_GET_TRUST_FLAGS((&trust), trustType);
-                if ((certFlags & CERTDB_VALID_CA) &&
-                    ((certFlags & requiredFlags) == requiredFlags)) {
+                if ((certFlags & requiredFlags) == requiredFlags) {
                         trusted = PKIX_TRUE;
                 }

Comment 1

[Kai Engert (:KaiE:)]

Attachment: Patch v1

Comment 2

[Nelson Bolyard (seldom reads bugmail)]

Comment on attachment 278821 [details] [diff] [review]
Patch v1

This looks familiar. :)

Comment 3

[Kai Engert (:KaiE:)]

fixed