982778 - mozilla::pkix::der::AlgorithmIdentifier leaves parameters of output value uninitialized

Status: RESOLVED FIXED

(Core :: Security: PSM, defect)

Description

[Stefan Arentz | :st3fan | ⏰ EST | he/him]

The AlgorithmIdentifierNoParams test fails because algorithmID.parameters.len is not initialized.

The der::AlgorithmIdentifier() ignores the parameters (is that correct? are those never used in certificates?) so even though it then correctly sets algorithmID.algorithm, it leaves algorithmID.parameters alone, which means the parameters contain junk value.

Since this is passed to NSS at some point, I think the algorithmID.parameters should be initialized to zero or whatever is appropriate for NSS.

Comment 1

[Stefan Arentz | :st3fan | ⏰ EST | he/him]

The AlgorithmIdentifierNullParams test is failing for the same reason.

Comment 2

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Thanks. I think this is definitely a bug that needs to be fixed ASAP.

Regarding whether the parameters should be ignored or not: let's see what NSS's processing does.

Comment 3

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Attachment: fix-uninitialized-output.patch

Comment 4

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

AlgorithmIdentifierNoParams The test is in bug 968490, cases AlgorithmIdentifierNullParams.

Comment 5

[Dana Keeler (she/her) [:keeler]]

Comment on attachment 8391556 [details] [diff] [review]
fix-uninitialized-output.patch

Review of attachment 8391556 [details] [diff] [review]:
-----------------------------------------------------------------

LGTM.

Comment 6

[Dana Keeler (she/her) [:keeler]]

I rebased this after the big rename and pushed to inbound:
https://hg.mozilla.org/integration/mozilla-inbound/rev/08032b8280c6

Comment 7

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/08032b8280c6