84057 - Crash visiting SSL site which has a UCS4 string in signer DN

Status: VERIFIED FIXED

(Core Graveyard :: Security: UI, defect)

Description

[James Nord]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:0.9+) Gecko/20010603
BuildID:    2001060308

When I view a page that is encrypted with a self-signed openSSL gernerated
certificate mozilla crashes in PIPNSS after you accept the certificate.


Reproducible: Always
Steps to Reproduce:
1. Go to https://mailhost.teilo.net/
2. Accept the certificate permenantly
3. Crash

Actual Results:  Mozilla crashes in PIPNSS.DLL

Expected Results:  Mozilla shows the page without crashing

Note that if you re-start mozilla you can view the certificates contents in the
preferences->security certs without mozilla crashing.
Also happens in Secure IMAP in mail&news 
also https://www.sm.luth.se/

Comment 1

[James Nord]

TalkBack IDs from 2001052504_0.9.1 (Downloaded 2001-06-04-11-0.9.1) 
(The nightly trunk did not have talkback enabled.)
TB31313855M
TB31312209Q

Comment 2

[Boris Zbarsky [:bzbarsky]]

Over to PSM

Comment 3

[John Unruh]

*** This bug has been marked as a duplicate of 79414 ***

Comment 4

[James Nord]

Bug 79414 is about v1 certificates.  mailhost.teilo.net uses a version 3 
certificate.

Comment 5

[Javier Delgadillo]

This appears to be a problem with NSS's implementation of CERT_AsciiToName

It fails converting the string "signer"

(gdb) print signer
$1 = 0x42412ec8 "E=[e-mail], CN=mailhost.teilo.net, OU=Internet mail,
O=teilo.net, L=Luleå, ST=Norrbotten, C=SE"

into a valid CERTName structure.  The UCS4 conversion function provided by NSS
doesn't like the encoding of the L=Luleå field.

Comment 6

[Javier Delgadillo]

Update summary

Comment 7

[Javier Delgadillo]

Attachment: Patch to fix crash

Comment 8

[Javier Delgadillo]

ddrinan: please review the patch.

Comment 9

[Robert Relyea]

Javi, These seems like a good patch for the beta, but we really should find out
what the NSS conversion routines do not like about the UCS4 encoding. Also, is
PSM using the default UCS encode/decode functions are is it using mozilla
supplied functions?

bob

Comment 10

[David P. Drinan]

r=ddrinan.

Comment 11

[Javier Delgadillo]

Bob,

After looking further into the problem, I think we were calling NSS incorrectly.
The string "signer" is a return value from SSL_SecurityStatus which correctly
interprets the CERTName structure and converts it to a UTF8 string.  If you take
that UTF8 string and then pass it to CERT_AsciiToName, CERT_ParseRFC1485AVA
thinks the character in question 'å' is a UCS4 string.  Since signer is really a
UTF8 string, decoding the character fails.

In essence, CERT_AsciiToName doesn't handle UTF8 strings.  Which may be the
desired effect of the function (as implied by the name).  I can file a separate
NSS bug to track that if you want.

Comment 12

[Christopher Blizzard (:blizzard)]

sr=blizzard

Comment 13

[Asa Dotzler [:asa]]

a= [e-mail] for checkin to the trunk.
(on behalf of drivers)

Comment 14

[Javier Delgadillo]

Fix has been checked in.

Comment 15

[Javier Delgadillo]

*** Bug 76035 has been marked as a duplicate of this bug. ***

Comment 16

[Javier Delgadillo]

*** Bug 79414 has been marked as a duplicate of this bug. ***

Comment 17

[John Unruh]

Verified fixed.