550203 - nssCKFWSession_SetOperationState reads uninitialized state.data[0] from NSSCKFWC_SetOperationState

Status: RESOLVED FIXED

(NSS :: Libraries, defect)

Description

[timeless]

1723 	NSSCKFWC_SetOperationState
1732 	{
1737 	  NSSItem state;

1780 	  error = nssCKFWSession_SetOperationState(fwSession, &state, eKey, aKey);

1140 	nssCKFWSession_SetOperationState
1147 	{

1189 	  ulBuffer = (CK_ULONG *)state->data;
1190 	  if( 0x43b4657 != ulBuffer[0] ) {

Comment 1

[timeless]

Attachment: proposal

This patch has an hg changeset header but is actually a cvs diff, i believe it should apply easily to both hg and cvs

Comment 2

[Nelson Bolyard (seldom reads bugmail)]

Comment on attachment 430533 [details] [diff] [review]
proposal

I'm passing this review request to Bob.  He's the expert on ckfw.

Comment 3

[Robert Relyea]

Comment on attachment 430533 [details] [diff] [review]
proposal

You've definately found a but, but the patch doesn't actually solve it.

The correct code would be 

state.data = pOperationState;
state.len = ulOperationStatelen;

bob

Comment 4

[Shailen]

Attachment: Patch V 1

Bob :

 Can you please review this patch ?

Thanks,
Shailendra

Comment 5

[Shailen]

Attachment: Patch Version 2

Bob :

 Please ignore my earlier patch and requesting to review this new patch

Thanks,
Shailendra

Comment 6

[Robert Relyea]

Comment on attachment 434215 [details] [diff] [review]
Patch Version 2

r+ do you need me to check it in?

bob

Comment 7

[Nelson Bolyard (seldom reads bugmail)]

Bob, yes, Please checkin the patch(es) you reviewed for Timeless.

Comment 8

[Robert Relyea]

Checking in wrap.c;
/cvsroot/mozilla/security/nss/lib/ckfw/wrap.c,v  <--  wrap.c
new revision: 1.19; previous revision: 1.18
done

Thanks timeless and shailen!

bob