74343 - PSM fails to handle very large CRLs

Status: VERIFIED FIXED

(Core Graveyard :: Security: UI, defect, P1)

Description

[Bob Lord]

From a user:
I found that two large CRLs (114 KB and 38 KB) would not load, while
smaller ones (under 17 KB) loaded without a problem.

Comment 1

[Bob Lord]

Target -> 2.0

Comment 2

[David P. Drinan]

-> p1

Comment 3

[Stephane Saux]

version -> 2.0
Need to keep this on the radar. RTM bugs query
we ran used version 2.0.

Comment 4

[David P. Drinan]

Adding relyea to cc-list.

I've traced the problem into NSS. The import of the crl is successful, it's the 
retrieval that fails. Here is the stack trace:

DecodeDBCrlEntry(_certDBEntryRevocation * 0x0012716c, SECItemStr * 0x00127194) 
line 876
CollectCrls(SECItemStr * 0x001271ec, SECItemStr * 0x001271d4, int 4, void * 
0x0500e2f8) line 6677 + 13 bytes
SEC_TraverseDBEntries(CERTCertDBHandleStr * 0x02c09c58, int 4, int (SECItemStr 
*, SECItemStr *, int, void *)* 0x0255e681 CollectCrls(SECItemStr *, SECItemStr 
*, int, void *), void * 0x0500e2f8) line 4546 + 19 bytes
SEC_LookupCrls(CERTCertDBHandleStr * 0x02c09c58, CERTCrlHeadNodeStr * * 
0x001274ec, int -1) line 6749 + 20 bytes

In DecodeDBCrlEntry, there is a check on the db entry length that fails:

/* is database entry correct length? */
entry->derCrl.len = ( ( dbentry->data[0] << 8 ) | dbentry->data[1] );
nnlen = ( ( dbentry->data[2] << 8 ) | dbentry->data[3] );
if ( ( entry->derCrl.len + nnlen + DB_CRL_ENTRY_HEADER_LEN ) != dbentry->len)    
{PORT_SetError(SEC_ERROR_BAD_DATABASE);
   goto loser;
}

When I try to retrieve the RSASecureServer.crl (size of 814K), entry->derCrl.len 
is 47682, nnlen is 42 and dbentry->len is 834160. The above length check fails 
and the crl cannot be retrieved.

Comment 5

[Robert Relyea]

Ah ha! Our current database format cannot handle any object greater then 64k-1
because it only has a 2 byte length! The good news is I can easily see what is
broken. The bad news is it will require a database change to make this work. I
may be able to hack something where we used the stored length to determine the
real length of the CRL, but I'm not sure what the risk is if you move this
database to an older application.

bob

Comment 6

[Robert Relyea]

Attachment: patch to mozilla/security/nss/lib/certdb/pcertdb.c

Comment 7

[Robert Relyea]

David,

Try the above patch and see if the large CRL still fails now....

bob

Comment 8

[David P. Drinan]

That works. I'm able to view the 850K CRL!

Comment 9

[David P. Drinan]

r=ddrinan for the patch proposed by relyea.

Javi, please review this patch also.

Comment 10

[Wan-Teh Chang]

I don't understand Bob's patch but I did spot a typo.
"64 M" should be "64 K".

Ian, could you please review Bob's patch?

Comment 11

[Ian McGreer]

looks fine to me.

Comment 12

[David P. Drinan]

Ian, 

Please give it an r=mcgreer.

Thanks.

Comment 13

[Ian McGreer]

r=mcgreer

Comment 14

[Wan-Teh Chang]

David, remember to fix the "64 M" in the comments. :)

Comment 15

[David P. Drinan]

Attachment: Updated patch with wtc's comments.

Comment 16

[David P. Drinan]

Adding blizzard to cc-list.

Chris,

Please super review.

Thanks,
David.

Comment 17

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

a=dbaron for trunk (or whatever NSS branch that the mozilla trunk uses) checkin
(on behalf of drivers)

Comment 18

[Stephane Saux]

PDT for PSM.

Comment 19

[Christopher Blizzard (:blizzard)]

sr=blizzard

Comment 20

[Stephane Saux]

PDT+ as per Steve Elmeer 6/20/2001

Comment 21

[David P. Drinan]

Checked into the NSS 3.2 branch and updated the NSS_CLIENT_TAG. I will close 
this bug when I check into the NSS trunk.

Comment 22

[David P. Drinan]

Checked in to thge trunk of NSS. Marking FIXED.

Comment 23

[John Unruh]

I'll need a testcase in order to verify this.

Comment 24

[David P. Drinan]

To get large crls go to crl.verisign.com. You will have to host the crl on a web 
server which has the mime type application/x-pkcs7-crl set for .crl files. I 
believe that all iPlanet/Netscape webservers have this mime type enabled by 
default. Then point your mozilla/N6.1 browser to the crl (or a link to it), 
click and the crl should be downloaded. To verify that is has downloaded 
successfully, go to edit|preferences|privacy and security|validation and click 
on "Manage CRLs..." button. A dialog will appear with a list of the crls in your 
database.

Comment 25

[Stephane Saux]

updated whiteboard: needs verification

Comment 26

[John Unruh]

Verified with a 497K CRL at http://junruh.mcom.com/crl/497k.crl

Comment 27

[Stephane Saux]

whiteboard->verified