From 533ed345db8034d8e87bba4c171e9c173bed8065 Mon Sep 17 00:00:00 2001 From: Kai Engert Date: Fri, 16 Oct 2015 08:04:16 +0200 Subject: [PATCH] Bug 1215200, Upgrade to NSPR 4.10.10 and NSS 3.20.1, landing release candidate tags, r=dkeeler --- nsprpub/TAG-INFO | 2 +- nsprpub/config/prdepend.h | 1 - nsprpub/configure | 2 +- nsprpub/configure.in | 2 +- nsprpub/lib/ds/plarena.c | 10 ++ nsprpub/lib/ds/plarena.h | 27 ++-- nsprpub/pr/include/md/_linux.cfg | 2 +- nsprpub/pr/include/prinit.h | 4 +- nsprpub/pr/tests/vercheck.c | 8 +- security/nss/TAG-INFO | 2 +- security/nss/coreconf/coreconf.dep | 1 + security/nss/lib/nss/nss.h | 4 +- security/nss/lib/softoken/softkver.h | 4 +- security/nss/lib/util/nssutil.h | 4 +- security/nss/lib/util/secasn1d.c | 199 ++++++++++++++++++++++++--- 15 files changed, 227 insertions(+), 45 deletions(-) diff --git a/nsprpub/TAG-INFO b/nsprpub/TAG-INFO index 8b5e54acbfc..19d1c2c68c0 100644 --- a/nsprpub/TAG-INFO +++ b/nsprpub/TAG-INFO @@ -1 +1 @@ -NSPR_4_10_9_RTM +NSPR_4_10_10_RC0 diff --git a/nsprpub/config/prdepend.h b/nsprpub/config/prdepend.h index 6c66b37ca0f..e49e92677e3 100644 --- a/nsprpub/config/prdepend.h +++ b/nsprpub/config/prdepend.h @@ -10,4 +10,3 @@ */ #error "Do not include this header file." - diff --git a/nsprpub/configure b/nsprpub/configure index f57867b1e91..09c56bfeb5a 100755 --- a/nsprpub/configure +++ b/nsprpub/configure @@ -2489,7 +2489,7 @@ test -n "$target_alias" && MOD_MAJOR_VERSION=4 MOD_MINOR_VERSION=10 -MOD_PATCH_VERSION=9 +MOD_PATCH_VERSION=10 NSPR_MODNAME=nspr20 _HAVE_PTHREADS= USE_PTHREADS= diff --git a/nsprpub/configure.in b/nsprpub/configure.in index 1b85637d8a8..836a9144fb0 100644 --- a/nsprpub/configure.in +++ b/nsprpub/configure.in @@ -16,7 +16,7 @@ dnl = Defaults dnl ======================================================== MOD_MAJOR_VERSION=4 MOD_MINOR_VERSION=10 -MOD_PATCH_VERSION=9 +MOD_PATCH_VERSION=10 NSPR_MODNAME=nspr20 _HAVE_PTHREADS= USE_PTHREADS= diff --git a/nsprpub/lib/ds/plarena.c b/nsprpub/lib/ds/plarena.c index 95e1931ee66..689496dca8f 100644 --- a/nsprpub/lib/ds/plarena.c +++ b/nsprpub/lib/ds/plarena.c @@ -93,6 +93,9 @@ PR_IMPLEMENT(void) PL_InitArenaPool( pool->mask = PR_BITMASK(PR_CeilingLog2(align)); pool->first.next = NULL; + /* Set all three addresses in pool->first to the same dummy value. + * These addresses are only compared with each other, but never + * dereferenced. */ pool->first.base = pool->first.avail = pool->first.limit = (PRUword)PL_ARENA_ALIGN(pool, &pool->first + 1); pool->current = &pool->first; @@ -144,10 +147,14 @@ PR_IMPLEMENT(void *) PL_ArenaAllocate(PLArenaPool *pool, PRUint32 nb) { PLArena *a; char *rp; /* returned pointer */ + PRUint32 nbOld; PR_ASSERT((nb & pool->mask) == 0); + nbOld = nb; nb = (PRUword)PL_ARENA_ALIGN(pool, nb); /* force alignment */ + if (nb < nbOld) + return NULL; /* attempt to allocate from arenas at pool->current */ { @@ -208,6 +215,7 @@ PR_IMPLEMENT(void *) PL_ArenaAllocate(PLArenaPool *pool, PRUint32 nb) PL_MAKE_MEM_NOACCESS((void*)a->avail, a->limit - a->avail); rp = (char *)a->avail; a->avail += nb; + PR_ASSERT(a->avail <= a->limit); /* the newly allocated arena is linked after pool->current * and becomes pool->current */ a->next = pool->current->next; @@ -230,6 +238,8 @@ PR_IMPLEMENT(void *) PL_ArenaGrow( { void *newp; + if (PR_UINT32_MAX - size < incr) + return NULL; PL_ARENA_ALLOCATE(newp, pool, size + incr); if (newp) memcpy(newp, p, size); diff --git a/nsprpub/lib/ds/plarena.h b/nsprpub/lib/ds/plarena.h index 8dcfb3e5da7..3e51f835b31 100644 --- a/nsprpub/lib/ds/plarena.h +++ b/nsprpub/lib/ds/plarena.h @@ -139,32 +139,37 @@ void __asan_unpoison_memory_region(void const volatile *addr, size_t size); PLArena *_a = (pool)->current; \ PRUint32 _nb = PL_ARENA_ALIGN(pool, nb); \ PRUword _p = _a->avail; \ - PRUword _q = _p + _nb; \ - if (_q > _a->limit) { \ + if (_nb < nb) { \ + _p = 0; \ + } else if (_nb > (_a->limit - _a->avail)) { \ _p = (PRUword)PL_ArenaAllocate(pool, _nb); \ } else { \ - _a->avail = _q; \ + _a->avail += _nb; \ } \ p = (void *)_p; \ - PL_MAKE_MEM_UNDEFINED(p, nb); \ - PL_ArenaCountAllocation(pool, nb); \ + if (p) { \ + PL_MAKE_MEM_UNDEFINED(p, nb); \ + PL_ArenaCountAllocation(pool, nb); \ + } \ PR_END_MACRO #define PL_ARENA_GROW(p, pool, size, incr) \ PR_BEGIN_MACRO \ PLArena *_a = (pool)->current; \ PRUint32 _incr = PL_ARENA_ALIGN(pool, incr); \ - PRUword _p = _a->avail; \ - PRUword _q = _p + _incr; \ - if (_p == (PRUword)(p) + PL_ARENA_ALIGN(pool, size) && \ - _q <= _a->limit) { \ + if (_incr < incr) { \ + p = NULL; \ + } else if (_a->avail == (PRUword)(p) + PL_ARENA_ALIGN(pool, size) && \ + _incr <= (_a->limit - _a->avail)) { \ PL_MAKE_MEM_UNDEFINED((unsigned char *)(p) + size, incr); \ - _a->avail = _q; \ + _a->avail += _incr; \ PL_ArenaCountInplaceGrowth(pool, size, incr); \ } else { \ p = PL_ArenaGrow(pool, p, size, incr); \ } \ - PL_ArenaCountGrowth(pool, size, incr); \ + if (p) {\ + PL_ArenaCountGrowth(pool, size, incr); \ + } \ PR_END_MACRO #define PL_ARENA_MARK(pool) ((void *) (pool)->current->avail) diff --git a/nsprpub/pr/include/md/_linux.cfg b/nsprpub/pr/include/md/_linux.cfg index 72e9debc7e8..8cbf0cb9b24 100644 --- a/nsprpub/pr/include/md/_linux.cfg +++ b/nsprpub/pr/include/md/_linux.cfg @@ -508,7 +508,7 @@ #error "Unknown MIPS endianness." #endif -#ifdef _ABI64 +#if _MIPS_SIM == _ABI64 #define IS_64 diff --git a/nsprpub/pr/include/prinit.h b/nsprpub/pr/include/prinit.h index 5b352e7303c..4d537b66b1c 100644 --- a/nsprpub/pr/include/prinit.h +++ b/nsprpub/pr/include/prinit.h @@ -31,10 +31,10 @@ PR_BEGIN_EXTERN_C ** The format of the version string is ** ".[.] []" */ -#define PR_VERSION "4.10.9" +#define PR_VERSION "4.10.10" #define PR_VMAJOR 4 #define PR_VMINOR 10 -#define PR_VPATCH 9 +#define PR_VPATCH 10 #define PR_BETA PR_FALSE /* diff --git a/nsprpub/pr/tests/vercheck.c b/nsprpub/pr/tests/vercheck.c index f5960284587..5cb2c465756 100644 --- a/nsprpub/pr/tests/vercheck.c +++ b/nsprpub/pr/tests/vercheck.c @@ -20,10 +20,10 @@ #include /* - * This release (4.10.7) is backward compatible with the + * This release (4.10.10) is backward compatible with the * 4.0.x, 4.1.x, 4.2.x, 4.3.x, 4.4.x, 4.5.x, 4.6.x, 4.7.x, * 4.8.x, 4.9.x, 4.10, 4.10.1, 4.10.2, 4.10.3, 4.10.4, - * 4.10.5, 4.10.6, 4.10.7 and 4.10.8 releases. + * 4.10.5, 4.10.6, 4.10.7, 4.10.8, 4.10.9 releases. * It, of course, is compatible with itself. */ static char *compatible_version[] = { @@ -39,7 +39,7 @@ static char *compatible_version[] = { "4.9", "4.9.1", "4.9.2", "4.9.3", "4.9.4", "4.9.5", "4.9.6", "4.10", "4.10.1", "4.10.2", "4.10.3", "4.10.4", - "4.10.5", "4.10.6", "4.10.7", "4.10.8", + "4.10.5", "4.10.6", "4.10.7", "4.10.8", "4.10.9", PR_VERSION }; @@ -55,7 +55,7 @@ static char *incompatible_version[] = { "3.0", "3.0.1", "3.1", "3.1.1", "3.1.2", "3.1.3", "3.5", "3.5.1", - "4.10.10", + "4.10.11", "4.11", "4.11.1", "10.0", "11.1", "12.14.20" }; diff --git a/security/nss/TAG-INFO b/security/nss/TAG-INFO index c113f6117b6..e6e301a526e 100644 --- a/security/nss/TAG-INFO +++ b/security/nss/TAG-INFO @@ -1 +1 @@ -NSS_3_20_RTM +NSS_3_20_1_RC0 diff --git a/security/nss/coreconf/coreconf.dep b/security/nss/coreconf/coreconf.dep index 5182f75552c..590d1bfaeee 100644 --- a/security/nss/coreconf/coreconf.dep +++ b/security/nss/coreconf/coreconf.dep @@ -10,3 +10,4 @@ */ #error "Do not include this header file." + diff --git a/security/nss/lib/nss/nss.h b/security/nss/lib/nss/nss.h index 824e4609672..4b5048e84fd 100644 --- a/security/nss/lib/nss/nss.h +++ b/security/nss/lib/nss/nss.h @@ -33,10 +33,10 @@ * The format of the version string should be * ".[.[.]][ ][ ]" */ -#define NSS_VERSION "3.20" _NSS_ECC_STRING _NSS_CUSTOMIZED +#define NSS_VERSION "3.20.1" _NSS_ECC_STRING _NSS_CUSTOMIZED #define NSS_VMAJOR 3 #define NSS_VMINOR 20 -#define NSS_VPATCH 0 +#define NSS_VPATCH 1 #define NSS_VBUILD 0 #define NSS_BETA PR_FALSE diff --git a/security/nss/lib/softoken/softkver.h b/security/nss/lib/softoken/softkver.h index 591a3956aec..ad25b28e4b6 100644 --- a/security/nss/lib/softoken/softkver.h +++ b/security/nss/lib/softoken/softkver.h @@ -25,10 +25,10 @@ * The format of the version string should be * ".[.[.]][ ][ ]" */ -#define SOFTOKEN_VERSION "3.20" SOFTOKEN_ECC_STRING +#define SOFTOKEN_VERSION "3.20.1" SOFTOKEN_ECC_STRING #define SOFTOKEN_VMAJOR 3 #define SOFTOKEN_VMINOR 20 -#define SOFTOKEN_VPATCH 0 +#define SOFTOKEN_VPATCH 1 #define SOFTOKEN_VBUILD 0 #define SOFTOKEN_BETA PR_FALSE diff --git a/security/nss/lib/util/nssutil.h b/security/nss/lib/util/nssutil.h index 6a3c8b9c573..828998e573c 100644 --- a/security/nss/lib/util/nssutil.h +++ b/security/nss/lib/util/nssutil.h @@ -19,10 +19,10 @@ * The format of the version string should be * ".[.[.]][ ]" */ -#define NSSUTIL_VERSION "3.20" +#define NSSUTIL_VERSION "3.20.1" #define NSSUTIL_VMAJOR 3 #define NSSUTIL_VMINOR 20 -#define NSSUTIL_VPATCH 0 +#define NSSUTIL_VPATCH 1 #define NSSUTIL_VBUILD 0 #define NSSUTIL_BETA PR_FALSE diff --git a/security/nss/lib/util/secasn1d.c b/security/nss/lib/util/secasn1d.c index d404b72dfec..7a5bcfd03a1 100644 --- a/security/nss/lib/util/secasn1d.c +++ b/security/nss/lib/util/secasn1d.c @@ -951,6 +951,33 @@ sec_asn1d_parse_more_length (sec_asn1d_state *state, return count; } +/* + * Helper function for sec_asn1d_prepare_for_contents. + * Checks that a value representing a number of bytes consumed can be + * subtracted from a remaining length. If so, returns PR_TRUE. + * Otherwise, sets the error SEC_ERROR_BAD_DER, indicates that there was a + * decoding error in the given SEC_ASN1DecoderContext, and returns PR_FALSE. + */ +static PRBool +sec_asn1d_check_and_subtract_length (unsigned long *remaining, + unsigned long consumed, + SEC_ASN1DecoderContext *cx) +{ + PORT_Assert(remaining); + PORT_Assert(cx); + if (!remaining || !cx) { + PORT_SetError (SEC_ERROR_INVALID_ARGS); + cx->status = decodeError; + return PR_FALSE; + } + if (*remaining < consumed) { + PORT_SetError (SEC_ERROR_BAD_DER); + cx->status = decodeError; + return PR_FALSE; + } + *remaining -= consumed; + return PR_TRUE; +} static void sec_asn1d_prepare_for_contents (sec_asn1d_state *state) @@ -958,6 +985,7 @@ sec_asn1d_prepare_for_contents (sec_asn1d_state *state) SECItem *item; PLArenaPool *poolp; unsigned long alloc_len; + sec_asn1d_state *parent; #ifdef DEBUG_ASN1D_STATES { @@ -966,6 +994,63 @@ sec_asn1d_prepare_for_contents (sec_asn1d_state *state) } #endif + /** + * The maximum length for a child element should be constrained to the + * length remaining in the first definite length element in the ancestor + * stack. If there is no definite length element in the ancestor stack, + * there's nothing to constrain the length of the child, so there's no + * further processing necessary. + * + * It's necessary to walk the ancestor stack, because it's possible to have + * definite length children that are part of an indefinite length element, + * which is itself part of an indefinite length element, and which is + * ultimately part of a definite length element. A simple example of this + * would be the handling of constructed OCTET STRINGs in BER encoding. + * + * This algorithm finds the first definite length element in the ancestor + * stack, if any, and if so, ensures that the length of the child element + * is consistent with the number of bytes remaining in the constraining + * ancestor element (that is, after accounting for any other sibling + * elements that may have been read). + * + * It's slightly complicated by the need to account both for integer + * underflow and overflow, as well as ensure that for indefinite length + * encodings, there's also enough space for the End-of-Contents (EOC) + * octets (Tag = 0x00, Length = 0x00, or two bytes). + */ + + /* Determine the maximum length available for this element by finding the + * first definite length ancestor, if any. */ + parent = sec_asn1d_get_enclosing_construct(state); + while (parent && parent->indefinite) { + parent = sec_asn1d_get_enclosing_construct(parent); + } + /* If parent is null, state is either the outermost state / at the top of + * the stack, or the outermost state uses indefinite length encoding. In + * these cases, there's nothing external to constrain this element, so + * there's nothing to check. */ + if (parent) { + unsigned long remaining = parent->pending; + parent = state; + do { + if (!sec_asn1d_check_and_subtract_length( + &remaining, parent->consumed, state->top) || + /* If parent->indefinite is true, parent->contents_length is + * zero and this is a no-op. */ + !sec_asn1d_check_and_subtract_length( + &remaining, parent->contents_length, state->top) || + /* If parent->indefinite is true, then ensure there is enough + * space for an EOC tag of 2 bytes. */ + (parent->indefinite && !sec_asn1d_check_and_subtract_length( + &remaining, 2, state->top))) { + /* This element is larger than its enclosing element, which is + * invalid. */ + return; + } + } while ((parent = sec_asn1d_get_enclosing_construct(parent)) && + parent->indefinite); + } + /* * XXX I cannot decide if this allocation should exclude the case * where state->endofcontents is true -- figure it out! @@ -1007,21 +1092,6 @@ sec_asn1d_prepare_for_contents (sec_asn1d_state *state) */ state->pending = state->contents_length; - /* If this item has definite length encoding, and - ** is enclosed by a definite length constructed type, - ** make sure it isn't longer than the remaining space in that - ** constructed type. - */ - if (state->contents_length > 0) { - sec_asn1d_state *parent = sec_asn1d_get_enclosing_construct(state); - if (parent && !parent->indefinite && - state->consumed + state->contents_length > parent->pending) { - PORT_SetError (SEC_ERROR_BAD_DER); - state->top->status = decodeError; - return; - } - } - /* * An EXPLICIT is nothing but an outer header, which we have * already parsed and accepted. Now we need to do the inner @@ -1720,10 +1790,107 @@ sec_asn1d_next_substring (sec_asn1d_state *state) if (state->pending == 0) done = PR_TRUE; } else { + PRBool preallocatedString; + sec_asn1d_state *temp_state; PORT_Assert (state->indefinite); item = (SECItem *)(child->dest); - if (item != NULL && item->data != NULL) { + + /** + * At this point, there's three states at play: + * child: The element that was just parsed + * state: The currently processed element + * 'parent' (aka state->parent): The enclosing construct + * of state, or NULL if this is the top-most element. + * + * This state handles both substrings of a constructed string AND + * child elements of items whose template type was that of + * SEC_ASN1_ANY, SEC_ASN1_SAVE, SEC_ASN1_ANY_CONTENTS, SEC_ASN1_SKIP + * template, as described in sec_asn1d_prepare_for_contents. For + * brevity, these will be referred to as 'string' and 'any' types. + * + * This leads to the following possibilities: + * 1: This element is an indefinite length string, part of a + * definite length string. + * 2: This element is an indefinite length string, part of an + * indefinite length string. + * 3: This element is an indefinite length any, part of a + * definite length any. + * 4: This element is an indefinite length any, part of an + * indefinite length any. + * 5: This element is an indefinite length any and does not + * meet any of the above criteria. Note that this would include + * an indefinite length string type matching an indefinite + * length any template. + * + * In Cases #1 and #3, the definite length 'parent' element will + * have allocated state->dest based on the parent elements definite + * size. During the processing of 'child', sec_asn1d_parse_leaf will + * have copied the (string, any) data directly into the offset of + * dest, as appropriate, so there's no need for this class to still + * store the child - it's already been processed. + * + * In Cases #2 and #4, dest will be set to the parent element's dest, + * but dest->data will not have been allocated yet, due to the + * indefinite length encoding. In this situation, it's necessary to + * hold onto child (and all other children) until the EOC, at which + * point, it becomes possible to compute 'state's overall length. Once + * 'state' has a computed length, this can then be fed to 'parent' (via + * this state), and then 'parent' can similarly compute the length of + * all of its children up to the EOC, which will ultimately transit to + * sec_asn1d_concat_substrings, determine the overall size needed, + * allocate, and copy the contents (of all of parent's children, which + * would include 'state', just as 'state' will have copied all of its + * children via sec_asn1d_concat_substrings) + * + * The final case, Case #5, will manifest in that item->data and + * item->len will be NULL/0, respectively, since this element was + * indefinite-length encoded. In that case, both the tag and length will + * already exist in state's subitems, via sec_asn1d_record_any_header, + * and so the contents (aka 'child') should be added to that list of + * items to concatenate in sec_asn1d_concat_substrings once the EOC + * is encountered. + * + * To distinguish #2/#4 from #1/#3, it's sufficient to walk the ancestor + * tree. If the current type is a string type, then the enclosing + * construct will be that same type (#1/#2). If the current type is an + * any type, then the enclosing construct is either an any type (#3/#4) + * or some other type (#5). Since this is BER, this nesting relationship + * between 'state' and 'parent' may go through several levels of + * constructed encoding, so continue walking the ancestor chain until a + * clear determination can be made. + * + * The variable preallocatedString is used to indicate Case #1/#3, + * indicating an in-place copy has already occurred, and Cases #2, #4, + * and #5 all have the same behaviour of adding a new substring. + */ + preallocatedString = PR_FALSE; + temp_state = state; + while (temp_state && item == temp_state->dest && temp_state->indefinite) { + sec_asn1d_state *parent = sec_asn1d_get_enclosing_construct(temp_state); + if (!parent || parent->underlying_kind != temp_state->underlying_kind) { + /* Case #5 - Either this is a top-level construct or it is part + * of some other element (e.g. a SEQUENCE), in which case, a + * new item should be allocated. */ + break; + } + if (!parent->indefinite) { + /* Cases #1 / #3 - A definite length ancestor exists, for which + * this is a substring that has already copied into dest. */ + preallocatedString = PR_TRUE; + break; + } + if (!parent->substring) { + /* Cases #2 / #4 - If the parent is not a substring, but is + * indefinite, then there's nothing further up that may have + * preallocated dest, thus child will not have already + * been copied in place, therefore it's necessary to save child + * as a subitem. */ + break; + } + temp_state = parent; + } + if (item != NULL && item->data != NULL && !preallocatedString) { /* * Save the string away for later concatenation. */