From a9e1a00a6ca61e349c8e0b37d7052d6f998a7305 Mon Sep 17 00:00:00 2001
From: Nalin Dahyabhai <nalin@dahyabhai.net>
Date: Tue, 19 Oct 2010 20:37:32 -0400
Subject: [PATCH 054/150] - don't wrap the dh param integer into a bit string
 - handle the is_signed result variable being NULL
 (apparently the caller doesn't always care)

---
 src/plugins/preauth/pkinit/pkinit_crypto_nss.c |   41 ++++++++++++-----------
 1 files changed, 21 insertions(+), 20 deletions(-)

diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_nss.c b/src/plugins/preauth/pkinit/pkinit_crypto_nss.c
index 0070fd9..d28e161 100644
--- a/src/plugins/preauth/pkinit/pkinit_crypto_nss.c
+++ b/src/plugins/preauth/pkinit/pkinit_crypto_nss.c
@@ -710,14 +710,14 @@ secitem_to_buf_len(SECItem *item, unsigned char **out, unsigned int *len)
 	return 0;
 }
 
-/* Encode the raw buffer as an unsigned integer, then into a bit string.  If
- * the first byte in the buffer has its high bit set, we need to prepend a zero
- * byte to make sure it isn't treated as a negative value. */
+/* Encode the raw buffer as an unsigned integer.  If the first byte in the
+ * buffer has its high bit set, we need to prepend a zero byte to make sure it
+ * isn't treated as a negative value. */
 static int
 secitem_to_dh_pubval(SECItem *item, unsigned char **out, unsigned int *len)
 {
 	PLArenaPool *pool;
-	SECItem *uval, uinteger, bits;
+	SECItem *uval, uinteger;
 	int i;
 
 	pool = PORT_NewArena(sizeof(double));
@@ -743,17 +743,8 @@ secitem_to_dh_pubval(SECItem *item, unsigned char **out, unsigned int *len)
 		PORT_FreeArena(pool, PR_TRUE);
 		return ENOMEM;
 	}
-	memset(&bits, 0, sizeof(bits));
-	/* Whenever encoding a bit string, NSS expects the length to be
-	 * measured in bits. */
-	uinteger.len *= 8;
-	if (SEC_ASN1EncodeItem(pool, &bits, &uinteger,
-			       SEC_BitStringTemplate) != &bits) {
-		PORT_FreeArena(pool, PR_TRUE);
-		return ENOMEM;
-	}
 
-	i = secitem_to_buf_len(&bits, out, len);
+	i = secitem_to_buf_len(&uinteger, out, len);
 
 	PORT_FreeArena(pool, PR_TRUE);
 	return i;
@@ -3256,6 +3247,11 @@ crypto_signeddata_common_verify(krb5_context context,
 		pkiDebug("%s: wrong number of signers\n", __FUNCTION__);
 		return ENOMEM; /* FIXME: better error? */
 	}
+	if (NSS_CMSSignedData_ImportCerts(sdata, certdb,
+					  usage, PR_FALSE) != SECSuccess) {
+		pkiDebug("%s: error importing signer certs\n", __FUNCTION__);
+		return ENOMEM; /* FIXME: better error? */
+	}
 	signer = NSS_CMSSignedData_GetSignerInfo(sdata, 0);
 	if (signer == NULL) {
 		pkiDebug("%s: no signers?\n", __FUNCTION__);
@@ -3301,9 +3297,7 @@ crypto_signeddata_common_verify(krb5_context context,
 	}
 	cert = NSS_CMSSignerInfo_GetSigningCertificate(signer, certdb);
 	req_cryptoctx->peer_cert = CERT_DupCertificate(cert);
-	if (is_signed != NULL) {
-		*is_signed = 1;
-	}
+	*is_signed = 1;
 	return 0;
 }
 
@@ -3560,6 +3554,7 @@ cms_signeddata_verify(krb5_context context,
 	SECOidTag expected_tag;
 	PLArenaPool *pool;
 	SECItem *plain, encoded;
+	int was_signed;
 
 	switch (cms_msg_type) {
 	case CMS_SIGN_DRAFT9:
@@ -3610,6 +3605,7 @@ cms_signeddata_verify(krb5_context context,
 		pkiDebug("%s: data is probably signed, checking\n",
 			 __FUNCTION__);
 		plain = NULL;
+		was_signed = 0;
 		if ((crypto_signeddata_common_verify(context,
 						     plg_cryptoctx,
 						     req_cryptoctx,
@@ -3620,18 +3616,23 @@ cms_signeddata_verify(krb5_context context,
 						     usage,
 						     expected_tag,
 						     &plain,
-						     is_signed) != 0) ||
+						     &was_signed) != 0) ||
 		    (plain == NULL) ||
-		    (!(*is_signed))) {
+		    (!was_signed)) {
 			NSS_CMSMessage_Destroy(msg);
 			PORT_FreeArena(pool, PR_TRUE);
 			return ENOMEM; /* FIXME: better error? */
 		}
+		if (is_signed != NULL) {
+			*is_signed = was_signed;
+		}
 		break;
 	case SEC_OID_PKCS7_DATA:
 		/* It's not signed: try to pull out the payload. */
 		pkiDebug("%s: data is not signed\n", __FUNCTION__);
-		*is_signed = 0;
+		if (is_signed != NULL) {
+			*is_signed = 0;
+		}
 		plain = NSS_CMSContentInfo_GetContent(info);
 		break;
 	default:
-- 
1.7.6.4