42916 - [ssl] Trying to add CA/server cert from web page crashes mozilla if PSM is not installed

Status: VERIFIED FIXED

(Core Graveyard :: Security: UI, defect, P3)

Description

[David Härdeman]

BuildID:    M16

Trying to add a CA from a page (one can be found at the example URL by clicking 
the "win"-icon) will crash mozilla (with an error in psmglue.dll) if PSM is not 
installed. This is somewhat related to bug #20503

Reproducible: Always
Steps to Reproduce:
1. Go to URL above
2. Click "win"-icon
3. See mozilla crash

Actual Results:  Mozilla crashed

Expected Results:  Mozilla should complain about PSM not being installed 

Does other unknown filetypes also crash moz?

Comment 1

[Peter "jag" Annema]

Linux, build ID 2000061708 crashes.

Windows 95, build ID 2000061708 crashes:

Translated from Dutch:
MOZILLA has caused an invalid page exception in module PSMGLUE.DLL at
0137:606c9693.
Registers:
EAX=0068f974 CS=0137 EIP=606c9693 EFLGS=00010246
EBX=00000000 SS=013f ESP=0068f950 EBP=0068f980
ECX=00000000 DS=013f ESI=00000000 FS=4367
EDX=00000001 ES=013f EDI=00000000 GS=0000
Bytes in CS:EIP:
8b 46 2c 85 c0 74 06 ff 30 ff 50 04 59 8b 7c 24
Stack-dump:
00000000 00000000 606c8d7e 00000000 0068f974 00000001 007b45f4 01ca96d0 000002e5
10004a00 01ca93d0 000002f0 0068f9ac 606c2246 00000000 01ca96d0

Confirming bug, suspecting this is cross platform.

Comment 2

[Doug Turner (:dougt)]

over to jud.

Comment 3

[leger]

Adding crash keyword

Comment 4

[John Unruh]

Reproducible on WinNT in mozilla.exe.

Comment 5

[John Unruh]

Fixed. I can import the CA into Linux and Win32.

Comment 6

[John Unruh]

Verified.

Comment 7

[David Härdeman]

It still doesnt work for me, please note that the bug is when you try to import 
a cert when PSM isn't installed, judging from "I can import the CA into Linux 
and Win32." I'm wondering if you have PSM installed?

With Win build 2000062608 Mozilla first hangs and when I kill it (with 
ctrl+alt+del) it gives me the following message:

PSM has caused an invalid page exception in module NSPR3.DLL at 0167:005c04e5.
Registers:
EAX=00000000 CS=0167 EIP=005c04e5 EFLGS=00010246
EBX=0081fd20 SS=016f ESP=0081fccc EBP=0081fe38
ECX=0081fe28 DS=016f ESI=00000000 FS=2317
EDX=00000004 ES=016f EDI=00993960 GS=0000
Bytes in CS:EIP:
8b 46 04 8b 08 51 e8 70 07 00 00 83 c4 04 8b 4e 
Stackdump:
00993960 0040370f 00000000 00000000 004029ed 00402582 00993960 00000001 ffffffff 
00993960 004030c7 00993960 00000000 00993610 00710000 004024c3 

Comment 8

[John Unruh]

Right. Reopening. The crash is reproducible if PSM is not installed.

Comment 9

[John Unruh]

Adding nsbeta2 keyword

Comment 10

[leger]

Putting on [nsbeta2+] radar to stop the crash.

Comment 11

[John Unruh]

Reassigning to Browser:General. Security:Crypto cannot be blamed for a crash in 
Mozilla if it is not installed. The original summary reads "Trying to add 
CA/server cert from web page crashes mozilla IF PSM IS NOT INSTALLED."

Comment 12

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Stack trace for segfault (on Linux):

#0  0x421e1f1f in CMT_SendMessage (control=0x0, message=0xbffff520) at
/builds/dbaron/debug/mozilla/security/psm/lib/client/cmtutils.c:295
#1  0x421e28da in CMT_DecodeAndCreateTempCert (control=0x0, data=0x42d17608
"0\202\002á0\202\002J\002\001", len=741, type=1) at
/builds/dbaron/debug/mozilla/security/psm/lib/client/cmtcert.c:75
#2  0x4231d6b7 in CertDownloader::OnStopRequest (this=0x42ba9440,
channel=0x42ba8fa8, context=0x42b58d60, aStatus=0, aMsg=0x0) at
/builds/dbaron/debug/mozilla/extensions/psm-glue/src/nsPSMComponent.cpp:675
#3  0x40e63596 in nsHTTPFinalListener::OnStopRequest (this=0x42ba9460,
aChannel=0x42ba8fa8, aContext=0x42b58d60, aStatus=0, aErrorMsg=0x0) at
/builds/dbaron/debug/mozilla/netwerk/protocol/http/src/nsHTTPResponseListener.cpp:1195
#4  0x421b0116 in InterceptStreamListener::OnStopRequest (this=0x428f2950,
channel=0x42ba8fa8, ctxt=0x42b58d60, status=0, errorMsg=0x0) at
/builds/dbaron/debug/mozilla/netwerk/cache/mgr/nsCachedNetData.cpp:1161
#5  0x40e58741 in nsHTTPChannel::ResponseCompleted (this=0x42ba8fa8,
aListener=0x428f2950, aStatus=0, aMsg=0x0) at
/builds/dbaron/debug/mozilla/netwerk/protocol/http/src/nsHTTPChannel.cpp:1700
#6  0x40e622f1 in nsHTTPServerListener::OnStopRequest (this=0x42d37cd0,
channel=0x428f3a04, i_pContext=0x42ba8fa8, i_Status=0, i_pMsg=0x0) at
/builds/dbaron/debug/mozilla/netwerk/protocol/http/src/nsHTTPResponseListener.cpp:721
#7  0x40dfaeb8 in nsOnStopRequestEvent::HandleEvent (this=0x80e9a78) at
/builds/dbaron/debug/mozilla/netwerk/base/src/nsAsyncStreamListener.cpp:313
#8  0x40dfa497 in nsStreamListenerEvent::HandlePLEvent (aEvent=0x80e6308) at
/builds/dbaron/debug/mozilla/netwerk/base/src/nsAsyncStreamListener.cpp:101
#9  0x401163fe in PL_HandleEvent (self=0x80e6308) at
/builds/dbaron/debug/mozilla/xpcom/threads/plevent.c:575
#10 0x401162ac in PL_ProcessPendingEvents (self=0x8066b28) at
/builds/dbaron/debug/mozilla/xpcom/threads/plevent.c:520
#11 0x40118039 in nsEventQueueImpl::ProcessPendingEvents (this=0x8066a70) at
/builds/dbaron/debug/mozilla/xpcom/threads/nsEventQueue.cpp:356
#12 0x40a755e4 in event_processor_callback (data=0x8066a70, source=9,
condition=GDK_INPUT_READ) at
/builds/dbaron/debug/mozilla/widget/src/gtk/nsAppShell.cpp:158
#13 0x40a7521f in our_gdk_io_invoke (source=0x41e41570, condition=G_IO_IN,
data=0x41edafd8) at
/builds/dbaron/debug/mozilla/widget/src/gtk/nsAppShell.cpp:58
#14 0x40c4052a in ?? () from /usr/lib/libglib-1.2.so.0
#15 0x40c41be6 in ?? () from /usr/lib/libglib-1.2.so.0
#16 0x40c421a1 in ?? () from /usr/lib/libglib-1.2.so.0
#17 0x40c42341 in ?? () from /usr/lib/libglib-1.2.so.0
#18 0x40b69209 in ?? () from /usr/lib/libgtk-1.2.so.0
#19 0x40a75cda in nsAppShell::Run (this=0x810a648) at
/builds/dbaron/debug/mozilla/widget/src/gtk/nsAppShell.cpp:334
#20 0x40729a54 in nsAppShellService::Run (this=0x810bdf8) at
/builds/dbaron/debug/mozilla/xpfe/appshell/src/nsAppShellService.cpp:386
#21 0x8053c55 in main1 (argc=1, argv=0xbffffb04, nativeApp=0x0) at
/builds/dbaron/debug/mozilla/xpfe/bootstrap/nsAppRunner.cpp:913
#22 0x805433e in main (argc=1, argv=0xbffffb04) at
/builds/dbaron/debug/mozilla/xpfe/bootstrap/nsAppRunner.cpp:1099

Comment 13

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

control is null, and nobody's checking whether it's null.

Who gets this bug?

Comment 14

[Michael La Guardia]

Removing nsbeta2+ for reconsideration.  This happens when PSM is not installed.
 It is always installed for Netscape commercial builds, therefore, I don't think
that we need to fix this before we ship pr2.

Comment 15

[karnaze (gone)]

Pierre, can you please triage.

Comment 16

[leger]

Putting on [nsbeta2-] radar. Not critical to beta2. 

Comment 17

[Pierre Saslawsky]

(Why was this bug sent to Browser-General?)

We have the same stack trace on the Mac as on Unix (I had to use an old Mac build 
to reproduce the crash because of bug 44627 that would have hidden it).

The crash occurs in CMT_DecodeAndCreateTempCert(). Changed Component to Security-
General. CCd mstoltz who is module owner. Reassigned to dougt who wrote the code.

Comment 18

[Mitchell Stoltz (not reading bugmail)]

Module should be security:crypto, as with all PSM issues.

Comment 19

[Doug Turner (:dougt)]

.

Comment 20

[Javier Delgadillo]

Assigning to ddrinan

Comment 21

[Daniel Veditz [:dveditz]]

Adding nsbeta2 keyword to bugs with nsbeta2 triage value in status field so the 
queries don't get screwed up

Comment 22

[David P. Drinan]

Setting status whiteboard to nsbeta3+.

Comment 23

[leger]

PR2 is out...adding [nsbeta2-] Already has [nsbeta3+]

Comment 24

[nitinp]

With the netscape6 build of 20000829 for linux without psm when I try to access
a server which will bring up the server cert it does not crash netscape6.

Comment 25

[David P. Drinan]

Fixed.

Comment 26

[David P. Drinan]

Fixed.

Comment 27

[John Unruh]

Verifying this depends on Mac bug 50931 - Security Pop-up windows are blank. 
This works on Win95 and Linux using PSM 1.3 9/5/2000. Removing crash keyword.

Comment 28

[John Unruh]

Verified with the 9/18 091908 Moz build.

Comment 29

[John Unruh]

Mass changing Security:Crypto to PSM

Comment 30

[John Unruh]

Mass changing Security:Crypto to PSM