78556 - Crash when viewing cert w/o a version entry

Status: VERIFIED FIXED

(Core Graveyard :: Security: UI, defect)

Description

[Javier Delgadillo]

The version field in a certificate is optional.  If the user tries to view a
certificate that does not have the version field set, the browser crashes in the
depths of PSM 2.

Patch coming shortly.

Comment 1

[Javier Delgadillo]

Attachment: Patch to fix crashing bug.

Comment 2

[Javier Delgadillo]

thayes,ddrinan: review please.

Comment 3

[David P. Drinan]

r=ddrinan.

Comment 4

[Christopher Blizzard (:blizzard)]

So by adding this check does it mean that SEC_ASN1DecodeInteger() in
GetIntValue() is crashing?  Can't we beef that up instead?  It seems odd to
check a member before passing it into the function because the function can't
handle it.

Comment 5

[Javier Delgadillo]

SEC_ASN1DecodeInteger is an NSS function, we can file a separate bug against
NSS, but even then we'd have to pick up a new version of NSS for us to get this
fix.  

We could push the test into GetIntValue and add logic to ProcessVersion to deal
with the bad output.

Comment 6

[Christopher Blizzard (:blizzard)]

Open a bug to mark that NSS should be fixed with a reminder to come back and fix
this code* and you have have a bright shiny sr=blizzard.

* Am I anal or what?

Comment 7

[Javier Delgadillo]

New bug opened:

http://bugzilla.mozilla.org/show_bug.cgi?id=78577

Comment 8

[Javier Delgadillo]

Fix checked in

Comment 9

[John Unruh]

Verified per javi's comment.