450468 - PSM calls NSS PRNG function while NSS is not initialized.

Status: RESOLVED WORKSFORME

(Core :: Security: PSM, defect)

Description

[Dennis Jacobfeuerborn]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1a2pre) Gecko/20080813020710 Minefield/3.1a2pre
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1a2pre) Gecko/20080813020710 Minefield/3.1a2pre

I'm seeing a lot of crashes which all seem to originate from libnssutil3.so:

http://crash-stats.mozilla.com/report/index/edd62d8a-6966-11dd-806f-001cc45a2c28?p=1
http://crash-stats.mozilla.com/report/index/f217ee8f-6965-11dd-ad5c-001cc4e2bf68?p=1
http://crash-stats.mozilla.com/report/index/eaf0f95e-6965-11dd-966b-001a4bd43e5c?p=1
http://crash-stats.mozilla.com/report/index/0f4956c0-6966-11dd-aa30-001a4bd43e5c?p=1


Reproducible: Always

Comment 1

[timeless]

none of those have symbols for nss/nssutils, luser?
they're probably different crashes.... is it possible you aren't using mozilla's nss?

Signature	libnssutil3.so@0x77ca
UUID	edd62d8a-6966-11dd-806f-001cc45a2c28
Time	2008-08-13 11:37:28-07:00
Uptime	61
Product	Firefox
Version	3.1a2pre
Build ID	20080813020710
OS	Linux
OS Version	0.0.0 Linux 2.6.27-0.244.rc2.git1.fc10.i686 #1 SMP Fri Aug 8 13:26:20 EDT 2008 i686 GNU/Linux
CPU	x86
CPU Info	AuthenticAMD family 1 model 75 stepping 2
Crash Reason	SIGSEGV
Crash Address	0x7a17ca
Comments	
Crashing Thread
Frame 	Module 	Signature 	Source
0 	libnssutil3.so 	libnssutil3.so@0x77ca 	
1 	libnss3.so 	libnss3.so@0x2adea 	
2 	libnss3.so 	libnss3.so@0x3bbd7 	
3 	libnss3.so 	libnss3.so@0x3be19 	
4 	libnss3.so 	libnss3.so@0x3bfb0 	
5 	libnss3.so 	libnss3.so@0x3c025 	
6 	libxul.so 	nsNSSComponent::RandomUpdate 	security/manager/ssl/src/nsNSSComponent.cpp:1949

Comment 2

[Nelson Bolyard (seldom reads bugmail)]

This is the same problem as bug 427715, except that this occurs in a path
using the PRNG, whereas bug 427715 occurs when using the hash APIs.
Either way, the problem is that PSM is calling NSS functions when it has
not yet initialized NSS.  

It's not clear to me whether this should be a duplicate of bug 427715 or not.
I think it's possible that a patch could be written that would fix bug 427715
and still not address the code path in this bug.

Comment 3

[Dennis Jacobfeuerborn]

(In reply to comment #1)
> none of those have symbols for nss/nssutils, luser?
> they're probably different crashes.... is it possible you aren't using
> mozilla's nss?

There are two versions on my machine: in /opt/firefox3/libnss* and /lib/libnss*. Taking a peek at run-mozilla.sh it looks like the version in the firefox directory gets picked up first through LD_LIBRARY_PATH.

I also tried a "yum remove nss" just to check what that would mean for the system and the result is that yum would remove 182 packages (among them openssh, rpm, yum) so it looks like /lib/libnss* is pretty central to the distribution these days (that distribution beeing Fedora Rawhide).

Comment 4

[Jesse Ruderman]

Dennis, are you still hitting this crash now that bug 427715 is fixed?  (It was fixed in Firefox 3.0.14 and Firefox 3.5.3.)

Comment 5

[Dennis Jacobfeuerborn]

I haven't seen this happening for a long time now so if the fix has only been checked in recently then maybe some other changes prevented me from running into this before. Anyway I think this bug can be closed.