998786 - OpenSC corrupts firefox memory

Status: RESOLVED INVALID

(Core :: Security, defect)

Description

[Luca Giuzzi]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:28.0) Gecko/20100101 Firefox/28.0 (Beta/Release)
Build ID: 20140319112400

Steps to reproduce:

I tried to authenticate to a web site using a smartcard via opensc on Fedora 20.
The authentication succeded, but afterwards I was unable to visit any site making use of SSL.



Actual results:

The errors I reveived were either
a) segmentation fault
b) ssl_error_bad_handshake_hash_value followed by sec_error_no_memory

I had the same problem both from the distribution version of firefox and from the code aurora version (firefox-30.0a2.en-US.linux-x86_64.tar.bz2 downloaded as of April 19, 2014). Using the same opensc module (opensc-pkcs11.so) with google chrome works.
I also tried using the latest version of opensc, but nothing changed and the debug output from the module does not show anything abnormal (this is the reason why I suppose the issue might be with firefox).

I opened the bug also here:
https://bugzilla.redhat.com/show_bug.cgi?id=1089476
https://github.com/OpenSC/OpenSC/issues/232


Expected results:

SSL should still be usable.

Comment 1

[:Cykesiopka]

Thanks for filing the report.

Unless I'm misunderstanding, this was an OpenSC issue addressed in https://github.com/OpenSC/OpenSC/pull/410, so I'm going to mark this bug as INVALID.