51443 - ssl3 functions call CERT_VerifyCert with bogus wincx arg

Status: ASSIGNED

(NSS :: Libraries, defect, P3)

Description

[Nelson Bolyard (seldom reads bugmail)]

This bug was formerly bugsplat bug 353438.

Two functions in ssl3con.c, ssl3_HandleCertificate() and
ssl3_RestartHandshakeAfterServerCert(), call CERT_VerifyCert() 
and pass it ss->authCertificateArg as the "wincx" parameter.  

This is completely bogus.  The ss->authCertificateArg argument
is defined by the application for its authCert callback function.
It is initialized to the default cert db handle, but it is 
changed whenever the application registers an authcert callback.

I don't know where this wincx value should come from, but it's
not from the authcert arg.

Comment 1

[Nelson Bolyard (seldom reads bugmail)]

reassigning to myself.

Comment 2

[Nelson Bolyard (seldom reads bugmail)]

I think the right fix for this involves an API change, so I'm marking 
this "future".

Comment 3

[Nelson Bolyard (seldom reads bugmail)]

Julien, Perhaps the libpkix work will fix this?  In any case, we should be 
sure that the libpkix work will not duplicate this problem.