This is an automated email from the ASF dual-hosted git repository. jimjag pushed a commit to branch nss-upgrade-dev in repository https://gitbox.apache.org/repos/asf/openoffice.git
commit 6e210416e5a4104b533cffe88da81529270e7cf5 Author: Jim Jagielski <[email protected]> AuthorDate: Wed Jul 1 09:49:01 2026 -0400 Upgrade bundled NSS to 3.112.5 (with NSPR 4.38.2) Bump the bundled NSS/NSPR from 3.39/4.20 (2018) to the current NSS ESR release 3.112.5 with NSPR 4.38.2, and re-work the AOO patch set for the new sources. Verified by a full clean arm64 macOS build (dmake unpack -> patch -> compile -> deliver, exit 0): all 12 libraries build as native arm64 (libnss3, libnspr4, libfreebl3, libsmime3, libssl3, libsoftokn3, libnssutil3, libnssdbm3, libplc4, libplds4, and the nssckbi pair). Patch changes: - Delete nss_sizes.patch: its CVE-2021-43527 signature-length hardening (checkedSignatureLen) is already upstream in 3.112.5. - nss.patch: drop the obsolete zlib/inflate.c hunk (upstream already rewrote the signed-shift UB), and fix an infinite make recursion in cmd/shlibsign. AOO comments out CHECKLIBS to disable FIPS .chk signing, which leaves CHECKLOC empty-but-defined, so "ifdef CHECKLOC" stayed true and ran a bare $(MAKE) that re-entered the default target forever once 3.112 added "DIRS = mangle" to shlibsign. Guard on non-empty instead: ifneq ($(strip $(CHECKLOC)),). - nss_macosx.patch: drop the NSPR configure arm64 hunk (3.112.5 NSPR maps aarch64 -> "-arch arm64" natively) and the sqlite config.mk hunk (only relevant pre-10.5; the deployment-target rewrite would wrongly define SQLITE_WITHOUT_ZONEMALLOC at the 11.0 baseline). Keep the Darwin.mk "override CPU_ARCH = aarch64" -- still required because uname -p reports "arm" on Apple Silicon and freebl selects 64-bit HACL only for aarch64. - nss_linux.patch / nss_freebsd.patch: re-path to nss-3.112.5 only. Windows patches (nss_win.patch, nss.patch.mingw) are left in place with FIXME notes: nss_win.patch is old-MSVC (<VS2010) shims that no longer apply to the rewritten freebl HACL sources, and nss.patch.mingw targets the ancient nss-3.13.6 mozilla/security layout. Both need regenerating on a Windows host and were not validated here. Only the macOS/arm64 path was built and verified; Linux/FreeBSD patches apply cleanly but were not built, and xmlsecurity (the sole consumer) was not rebuilt against the new headers. --- main/external_deps.lst | 6 +- main/nss/makefile.mk | 14 ++- main/nss/nss.patch | 85 +++++++------- main/nss/nss_freebsd.patch | 6 +- main/nss/nss_linux.patch | 6 +- main/nss/nss_macosx.patch | 41 +------ main/nss/nss_sizes.patch | 276 --------------------------------------------- 7 files changed, 61 insertions(+), 373 deletions(-) diff --git a/main/external_deps.lst b/main/external_deps.lst index 07a35373ca..ae4e4f92f4 100644 --- a/main/external_deps.lst +++ b/main/external_deps.lst @@ -301,9 +301,9 @@ if (ENABLE_CATEGORY_B==YES && SOLAR_JAVA==TRUE && ENABLE_JAVASCRIPT==YES) URL2 = $(OOO_EXTRAS)$(MD5)-$(name) if (ENABLE_CATEGORY_B==YES && ENABLE_NSS_MODULE==YES) - MD5 = 8ac77166663de5c33bba6cb3d0066929 - name = nss-3.39-with-nspr-4.20.tar.gz - URL1 = https://ftp.mozilla.org/pub/security/nss/releases/NSS_3_39_RTM/src/$(name) + MD5 = 8b373566dd5bba69f2cd6e63f733ae65 + name = nss-3.112.5-with-nspr-4.38.2.tar.gz + URL1 = https://ftp.mozilla.org/pub/security/nss/releases/NSS_3_112_5_RTM/src/$(name) URL2 = $(OOO_EXTRAS)$(MD5)-$(name) if (ENABLE_CATEGORY_B==YES && SYSTEM_SAXON!=YES && DISABLE_SAXON!=YES && SOLAR_JAVA==TRUE) diff --git a/main/nss/makefile.mk b/main/nss/makefile.mk index 106143e7fe..a85329f162 100644 --- a/main/nss/makefile.mk +++ b/main/nss/makefile.mk @@ -37,11 +37,10 @@ all: .ELSE -TARFILE_NAME=nss-3.39-with-nspr-4.20 -TARFILE_MD5=8ac77166663de5c33bba6cb3d0066929 -TARFILE_ROOTDIR=nss-3.39 +TARFILE_NAME=nss-3.112.5-with-nspr-4.38.2 +TARFILE_MD5=8b373566dd5bba69f2cd6e63f733ae65 +TARFILE_ROOTDIR=nss-3.112.5 PATCH_FILES=nss.patch -PATCH_FILES+=nss_sizes.patch .IF "$(OS)"=="MACOSX" MACOS_SDK_DIR=$(SDK_PATH) @@ -85,6 +84,9 @@ BUILD_ACTION+=NSS_DISABLE_GTESTS=1 NSS_ENABLE_WERROR=0 .IF "$(COM)"=="GCC" +# FIXME: nss.patch.mingw was written against the ancient nss-3.13.6 +# "mozilla/security/nss" source layout and does NOT apply to nss-3.112.5. +# The MinGW Windows build needs this patch regenerated on a Windows host. PATCH_FILES+=nss.patch.mingw moz_build:=$(shell cygpath -p $(MOZILLABUILD)) @@ -121,6 +123,10 @@ OUT2LIB= \ .ELSE # "$(COM)"=="GCC" MOZ_MSVCVERSION= 9 .EXPORT : MOZ_MSVCVERSION +# FIXME: nss_win.patch is a set of old-MSVC (VS2008/_MSC_VER<1900) compatibility +# shims written against nss-3.39; ~16 of its files no longer apply to nss-3.112.5 +# (freebl HACL crypto sources were rewritten upstream). The MSVC Windows build +# needs this patch regenerated/trimmed on a Windows host with a modern toolchain. PATCH_FILES+=nss_win.patch moz_build:=$(shell cygpath -p $(MOZILLABUILD)) diff --git a/main/nss/nss.patch b/main/nss/nss.patch index 18016e4c0e..cfd2fb1e44 100644 --- a/main/nss/nss.patch +++ b/main/nss/nss.patch @@ -1,6 +1,6 @@ -diff -ur misc/nss-3.39/nspr/configure misc/build/nss-3.39/nspr/configure ---- misc/nss-3.39/nspr/configure 2018-08-28 05:42:28.000000000 -0700 -+++ misc/build/nss-3.39/nspr/configure 2020-10-06 07:41:59.563345390 -0700 +diff -ur misc/nss-3.112.5/nspr/configure misc/build/nss-3.112.5/nspr/configure +--- misc/nss-3.112.5/nspr/configure 2018-08-28 05:42:28.000000000 -0700 ++++ misc/build/nss-3.112.5/nspr/configure 2020-10-06 07:41:59.563345390 -0700 @@ -7039,7 +7039,7 @@ PR_MD_CSRCS=linux.c MKSHLIB='$(CC) $(DSO_LDOPTS) -o $@' @@ -10,9 +10,9 @@ diff -ur misc/nss-3.39/nspr/configure misc/build/nss-3.39/nspr/configure _OPTIMIZE_FLAGS=-O2 _DEBUG_FLAGS="-g -fno-inline" # most people on linux use gcc/gdb, and that # combo is not yet good at debugging inlined -diff -ur misc/nss-3.39/nspr/pr/include/pratom.h misc/build/nss-3.39/nspr/pr/include/pratom.h ---- misc/nss-3.39/nspr/pr/include/pratom.h 2018-08-28 05:42:28.000000000 -0700 -+++ misc/build/nss-3.39/nspr/pr/include/pratom.h 2020-10-06 07:41:59.563345390 -0700 +diff -ur misc/nss-3.112.5/nspr/pr/include/pratom.h misc/build/nss-3.112.5/nspr/pr/include/pratom.h +--- misc/nss-3.112.5/nspr/pr/include/pratom.h 2018-08-28 05:42:28.000000000 -0700 ++++ misc/build/nss-3.112.5/nspr/pr/include/pratom.h 2020-10-06 07:41:59.563345390 -0700 @@ -81,7 +81,9 @@ #if defined(_WIN32) && !defined(_WIN32_WCE) && \ (!defined(_MSC_VER) || (_MSC_VER >= 1310)) @@ -23,9 +23,9 @@ diff -ur misc/nss-3.39/nspr/pr/include/pratom.h misc/build/nss-3.39/nspr/pr/incl #ifdef _MSC_VER #pragma intrinsic(_InterlockedIncrement) -diff -ur misc/nss-3.39/nss/cmd/platlibs.mk misc/build/nss-3.39/nss/cmd/platlibs.mk ---- misc/nss-3.39/nss/cmd/platlibs.mk 2018-08-31 05:55:53.000000000 -0700 -+++ misc/build/nss-3.39/nss/cmd/platlibs.mk 2020-10-06 07:41:59.567345437 -0700 +diff -ur misc/nss-3.112.5/nss/cmd/platlibs.mk misc/build/nss-3.112.5/nss/cmd/platlibs.mk +--- misc/nss-3.112.5/nss/cmd/platlibs.mk 2018-08-31 05:55:53.000000000 -0700 ++++ misc/build/nss-3.112.5/nss/cmd/platlibs.mk 2020-10-06 07:41:59.567345437 -0700 @@ -10,17 +10,18 @@ ifeq ($(OS_ARCH), SunOS) @@ -49,10 +49,10 @@ diff -ur misc/nss-3.39/nss/cmd/platlibs.mk misc/build/nss-3.39/nss/cmd/platlibs. endif endif -diff -ur misc/nss-3.39/nss/cmd/shlibsign/Makefile misc/build/nss-3.39/nss/cmd/shlibsign/Makefile ---- misc/nss-3.39/nss/cmd/shlibsign/Makefile 2018-08-31 05:55:53.000000000 -0700 -+++ misc/build/nss-3.39/nss/cmd/shlibsign/Makefile 2020-10-06 07:41:59.567345437 -0700 -@@ -49,10 +49,15 @@ +diff -ur misc/nss-3.112.5/nss/cmd/shlibsign/Makefile misc/build/nss-3.112.5/nss/cmd/shlibsign/Makefile +--- misc/nss-3.112.5/nss/cmd/shlibsign/Makefile 2018-08-31 05:55:53.000000000 -0700 ++++ misc/build/nss-3.112.5/nss/cmd/shlibsign/Makefile 2020-10-06 07:41:59.567345437 -0700 +@@ -31,10 +31,15 @@ CHECKLIBS = CHECKLOC = else @@ -71,9 +71,17 @@ diff -ur misc/nss-3.39/nss/cmd/shlibsign/Makefile misc/build/nss-3.39/nss/cmd/sh endif CHECKLOC = $(CHECKLIBS:.$(DLL_SUFFIX)=.chk) -diff -ur misc/nss-3.39/nss/coreconf/Darwin.mk misc/build/nss-3.39/nss/coreconf/Darwin.mk ---- misc/nss-3.39/nss/coreconf/Darwin.mk 2018-08-31 05:55:53.000000000 -0700 -+++ misc/build/nss-3.39/nss/coreconf/Darwin.mk 2020-10-06 07:51:49.590356560 -0700 +@@ -73,6 +78,6 @@ + + + libs: install +-ifdef CHECKLOC ++ifneq ($(strip $(CHECKLOC)),) + $(MAKE) $(CHECKLOC) + endif +diff -ur misc/nss-3.112.5/nss/coreconf/Darwin.mk misc/build/nss-3.112.5/nss/coreconf/Darwin.mk +--- misc/nss-3.112.5/nss/coreconf/Darwin.mk 2018-08-31 05:55:53.000000000 -0700 ++++ misc/build/nss-3.112.5/nss/coreconf/Darwin.mk 2020-10-06 07:51:49.590356560 -0700 @@ -3,14 +3,15 @@ # License, v. 2.0. If a copy of the MPL was not distributed with this # file, You can obtain one at http://mozilla.org/MPL/2.0/. @@ -94,9 +102,9 @@ diff -ur misc/nss-3.39/nss/coreconf/Darwin.mk misc/build/nss-3.39/nss/coreconf/D ifndef CPU_ARCH # When cross-compiling, CPU_ARCH should already be defined as the target -diff -ur misc/nss-3.39/nss/coreconf/FreeBSD.mk misc/build/nss-3.39/nss/coreconf/FreeBSD.mk ---- misc/nss-3.39/nss/coreconf/FreeBSD.mk 2018-08-31 05:55:53.000000000 -0700 -+++ misc/build/nss-3.39/nss/coreconf/FreeBSD.mk 2020-10-06 07:41:59.567345437 -0700 +diff -ur misc/nss-3.112.5/nss/coreconf/FreeBSD.mk misc/build/nss-3.112.5/nss/coreconf/FreeBSD.mk +--- misc/nss-3.112.5/nss/coreconf/FreeBSD.mk 2018-08-31 05:55:53.000000000 -0700 ++++ misc/build/nss-3.112.5/nss/coreconf/FreeBSD.mk 2020-10-06 07:41:59.567345437 -0700 @@ -5,9 +5,8 @@ include $(CORE_DEPTH)/coreconf/UNIX.mk @@ -118,9 +126,9 @@ diff -ur misc/nss-3.39/nss/coreconf/FreeBSD.mk misc/build/nss-3.39/nss/coreconf/ DSO_CFLAGS = -fPIC DSO_LDOPTS = -shared -Wl,-soname -Wl,$(notdir $@) -diff -ur misc/nss-3.39/nss/coreconf/Linux.mk misc/build/nss-3.39/nss/coreconf/Linux.mk ---- misc/nss-3.39/nss/coreconf/Linux.mk 2018-08-31 05:55:53.000000000 -0700 -+++ misc/build/nss-3.39/nss/coreconf/Linux.mk 2020-10-06 07:41:59.567345437 -0700 +diff -ur misc/nss-3.112.5/nss/coreconf/Linux.mk misc/build/nss-3.112.5/nss/coreconf/Linux.mk +--- misc/nss-3.112.5/nss/coreconf/Linux.mk 2018-08-31 05:55:53.000000000 -0700 ++++ misc/build/nss-3.112.5/nss/coreconf/Linux.mk 2020-10-06 07:41:59.567345437 -0700 @@ -140,7 +140,7 @@ endif @@ -144,9 +152,9 @@ diff -ur misc/nss-3.39/nss/coreconf/Linux.mk misc/build/nss-3.39/nss/coreconf/Li # The -rpath '$$ORIGIN' linker option instructs this library to search for its # dependencies in the same directory where it resides. -diff -ur misc/nss-3.39/nss/coreconf/rules.mk misc/build/nss-3.39/nss/coreconf/rules.mk ---- misc/nss-3.39/nss/coreconf/rules.mk 2018-08-31 05:55:53.000000000 -0700 -+++ misc/build/nss-3.39/nss/coreconf/rules.mk 2020-10-06 07:41:59.567345437 -0700 +diff -ur misc/nss-3.112.5/nss/coreconf/rules.mk misc/build/nss-3.112.5/nss/coreconf/rules.mk +--- misc/nss-3.112.5/nss/coreconf/rules.mk 2018-08-31 05:55:53.000000000 -0700 ++++ misc/build/nss-3.112.5/nss/coreconf/rules.mk 2020-10-06 07:41:59.567345437 -0700 @@ -322,7 +322,12 @@ ifdef NS_USE_GCC $(RC) $(filter-out -U%,$(DEFINES)) $(INCLUDES:-I%=--include-dir %) -o $@ $< @@ -161,9 +169,9 @@ diff -ur misc/nss-3.39/nss/coreconf/rules.mk misc/build/nss-3.39/nss/coreconf/ru endif @echo $(RES) finished endif -diff -ur misc/nss-3.39/nss/coreconf/SunOS5.mk misc/build/nss-3.39/nss/coreconf/SunOS5.mk ---- misc/nss-3.39/nss/coreconf/SunOS5.mk 2018-08-31 05:55:53.000000000 -0700 -+++ misc/build/nss-3.39/nss/coreconf/SunOS5.mk 2020-10-06 07:41:59.567345437 -0700 +diff -ur misc/nss-3.112.5/nss/coreconf/SunOS5.mk misc/build/nss-3.112.5/nss/coreconf/SunOS5.mk +--- misc/nss-3.112.5/nss/coreconf/SunOS5.mk 2018-08-31 05:55:53.000000000 -0700 ++++ misc/build/nss-3.112.5/nss/coreconf/SunOS5.mk 2020-10-06 07:41:59.567345437 -0700 @@ -48,8 +48,12 @@ # OPTIMIZER += -mno-omit-leaf-frame-pointer -fno-omit-frame-pointer endif @@ -179,24 +187,9 @@ diff -ur misc/nss-3.39/nss/coreconf/SunOS5.mk misc/build/nss-3.39/nss/coreconf/S ASFLAGS += -Wa,-P OS_CFLAGS += $(NOMD_OS_CFLAGS) $(ARCHFLAG) ifndef BUILD_OPT -diff -ur misc/nss-3.39/nss/lib/zlib/inflate.c misc/build/nss-3.39/nss/lib/zlib/inflate.c ---- misc/nss-3.39/nss/lib/zlib/inflate.c 2018-08-31 05:55:53.000000000 -0700 -+++ misc/build/nss-3.39/nss/lib/zlib/inflate.c 2020-10-06 07:41:59.567345437 -0700 -@@ -1472,9 +1472,9 @@ - { - struct inflate_state FAR *state; - -- if (strm == Z_NULL || strm->state == Z_NULL) return -1L << 16; -+ if (strm == Z_NULL || strm->state == Z_NULL) return ~0UL << 16; - state = (struct inflate_state FAR *)strm->state; -- return ((long)(state->back) << 16) + -+ return ((unsigned long)(state->back) << 16) + - (state->mode == COPY ? state->length : - (state->mode == MATCH ? state->was - state->length : 0)); - } -diff -ur misc/nss-3.39/nss/Makefile misc/build/nss-3.39/nss/Makefile ---- misc/nss-3.39/nss/Makefile 2018-08-31 05:55:53.000000000 -0700 -+++ misc/build/nss-3.39/nss/Makefile 2020-10-06 07:41:59.567345437 -0700 +diff -ur misc/nss-3.112.5/nss/Makefile misc/build/nss-3.112.5/nss/Makefile +--- misc/nss-3.112.5/nss/Makefile 2018-08-31 05:55:53.000000000 -0700 ++++ misc/build/nss-3.112.5/nss/Makefile 2020-10-06 07:41:59.567345437 -0700 @@ -77,6 +77,9 @@ ifeq ($(OS_TARGET),WIN95) NSPR_CONFIGURE_OPTS += --enable-win32-target=WIN95 diff --git a/main/nss/nss_freebsd.patch b/main/nss/nss_freebsd.patch index 2392978403..7141d5872a 100644 --- a/main/nss/nss_freebsd.patch +++ b/main/nss/nss_freebsd.patch @@ -1,6 +1,6 @@ -diff -ur misc/nss-3.39/nss/coreconf/FreeBSD.mk misc/build/nss-3.39/nss/coreconf/FreeBSD.mk ---- misc/nss-3.39/nss/coreconf/FreeBSD.mk 2018-08-31 05:55:53.000000000 -0700 -+++ misc/build/nss-3.39/nss/coreconf/FreeBSD.mk 2018-09-10 10:27:48.913472000 -0700 +diff -ur misc/nss-3.112.5/nss/coreconf/FreeBSD.mk misc/build/nss-3.112.5/nss/coreconf/FreeBSD.mk +--- misc/nss-3.112.5/nss/coreconf/FreeBSD.mk 2018-08-31 05:55:53.000000000 -0700 ++++ misc/build/nss-3.112.5/nss/coreconf/FreeBSD.mk 2018-09-10 10:27:48.913472000 -0700 @@ -5,9 +5,8 @@ include $(CORE_DEPTH)/coreconf/UNIX.mk diff --git a/main/nss/nss_linux.patch b/main/nss/nss_linux.patch index cc8cad2f21..d68e724e1d 100644 --- a/main/nss/nss_linux.patch +++ b/main/nss/nss_linux.patch @@ -1,6 +1,6 @@ -diff -ur misc/nss-3.39/nss/lib/freebl/Makefile misc/build/nss-3.39/nss/lib/freebl/Makefile ---- misc/nss-3.39/nss/lib/freebl/Makefile 2018-08-31 05:55:53.000000000 -0700 -+++ misc/build/nss-3.39/nss/lib/freebl/Makefile 2018-09-10 10:33:50.973984000 -0700 +diff -ur misc/nss-3.112.5/nss/lib/freebl/Makefile misc/build/nss-3.112.5/nss/lib/freebl/Makefile +--- misc/nss-3.112.5/nss/lib/freebl/Makefile 2018-08-31 05:55:53.000000000 -0700 ++++ misc/build/nss-3.112.5/nss/lib/freebl/Makefile 2018-09-10 10:33:50.973984000 -0700 @@ -156,8 +156,8 @@ # The Intel AES assembly code requires Visual C++ 2010. # if $(_MSC_VER) >= 1600 (Visual C++ 2010) diff --git a/main/nss/nss_macosx.patch b/main/nss/nss_macosx.patch index 15a2bac890..7934a02174 100644 --- a/main/nss/nss_macosx.patch +++ b/main/nss/nss_macosx.patch @@ -1,25 +1,6 @@ -diff -ur misc/nss-3.39/nspr/configure misc/build/nss-3.39/nspr/configure ---- misc/nss-3.39/nspr/configure 2018-08-28 05:42:28.000000000 -0700 -+++ misc/build/nss-3.39/nspr/configure 2020-10-06 07:41:59.563345390 -0700 -@@ -6570,8 +6570,14 @@ - AS='$(CC) -x assembler-with-cpp' - CFLAGS="$CFLAGS -Wall -fno-common" - case "${target_cpu}" in -+ aarch64|arm64) -+ CPU_ARCH=arm64 -+ ;; - arm*) -- CPU_ARCH=arm -+ # On Apple Silicon the bundled config.guess reports the bare CPU -+ # "arm"; the macOS arch name is "arm64" (plain "arm" makes ld pick -+ # the nonexistent armv4t). Treat any arm on Darwin as arm64. -+ CPU_ARCH=arm64 - ;; - i*86*|x86_64) - if test -n "$USE_64"; then -diff -ur misc/nss-3.39/nss/coreconf/Darwin.mk misc/build/nss-3.39/nss/coreconf/Darwin.mk ---- misc/nss-3.39/nss/coreconf/Darwin.mk 2018-08-31 05:55:53.000000000 -0700 -+++ misc/build/nss-3.39/nss/coreconf/Darwin.mk 2020-10-06 07:51:49.590356560 -0700 +diff -ur misc/nss-3.112.5/nss/coreconf/Darwin.mk misc/build/nss-3.112.5/nss/coreconf/Darwin.mk +--- misc/nss-3.112.5/nss/coreconf/Darwin.mk 2018-08-31 05:55:53.000000000 -0700 ++++ misc/build/nss-3.112.5/nss/coreconf/Darwin.mk 2020-10-06 07:51:49.590356560 -0700 @@ -32,7 +32,13 @@ endif else @@ -35,19 +16,3 @@ diff -ur misc/nss-3.39/nss/coreconf/Darwin.mk misc/build/nss-3.39/nss/coreconf/D else OS_REL_CFLAGS = -Dppc CC += -arch ppc -diff -ur misc/nss-3.39/nss/lib/sqlite/config.mk misc/build/nss-3.39/nss/lib/sqlite/config.mk ---- misc/nss-3.39/nss/lib/sqlite/config.mk 2018-08-31 05:55:53.000000000 -0700 -+++ misc/build/nss-3.39/nss/lib/sqlite/config.mk 2018-09-10 10:36:01.074375000 -0700 -@@ -35,9 +35,9 @@ - # OSAtomicCompareAndSwapPtrBarrier, which is only available on Mac OS X 10.5 - # (Darwin 9.0) and later. Define SQLITE_WITHOUT_ZONEMALLOC to disable - # that code for older versions of Mac OS X. See bug 820374. --DARWIN_VER_MAJOR := $(shell uname -r | cut -f1 -d.) --DARWIN_LT_9 := $(shell [ $(DARWIN_VER_MAJOR) -lt 9 ] && echo true) --ifeq ($(DARWIN_LT_9),true) -+OSX_TARGET_MINOR := $(shell echo $(MACOSX_DEPLOYMENT_TARGET) | cut -f2 -d.) -+OSX_MINOR_LT_5 := $(shell [ $(OSX_TARGET_MINOR) -lt 5 ] && echo true) -+ifeq ($(OSX_MINOR_LT_5),true) - OS_CFLAGS += -DSQLITE_WITHOUT_ZONEMALLOC - endif - endif # Darwin diff --git a/main/nss/nss_sizes.patch b/main/nss/nss_sizes.patch deleted file mode 100644 index 9806deb6f5..0000000000 --- a/main/nss/nss_sizes.patch +++ /dev/null @@ -1,276 +0,0 @@ -diff -ur misc/nss-3.39/nss/lib/cryptohi/secvfy.c misc/build/nss-3.39/nss/lib/cryptohi/secvfy.c ---- misc/nss-3.39/nss/lib/cryptohi/secvfy.c 2018-08-31 14:55:53.000000000 +0200 -+++ misc/build/nss-3.39/nss/lib/cryptohi/secvfy.c 2022-02-05 22:36:19.617132698 +0100 -@@ -164,6 +164,37 @@ - PR_FALSE /*XXX: unsafeAllowMissingParameters*/); - } - -+static unsigned int -+checkedSignatureLen(const SECKEYPublicKey *pubk) -+{ -+ unsigned int sigLen = SECKEY_SignatureLen(pubk); -+ unsigned int maxSigLen; -+ if (sigLen == 0) { -+ /* Error set by SECKEY_SignatureLen */ -+ return sigLen; -+ } -+ switch (pubk->keyType) { -+ case rsaKey: -+ case rsaPssKey: -+ maxSigLen = (RSA_MAX_MODULUS_BITS + 7) / 8; -+ break; -+ case dsaKey: -+ maxSigLen = DSA_MAX_SIGNATURE_LEN; -+ break; -+ case ecKey: -+ maxSigLen = 2 * MAX_ECKEY_LEN; -+ break; -+ default: -+ PORT_SetError(SEC_ERROR_UNSUPPORTED_KEYALG); -+ return 0; -+ } -+ if (sigLen > maxSigLen) { -+ PORT_SetError(SEC_ERROR_INVALID_KEY); -+ return 0; -+ } -+ return sigLen; -+} -+ - /* - * decode the ECDSA or DSA signature from it's DER wrapping. - * The unwrapped/raw signature is placed in the buffer pointed -@@ -174,38 +205,38 @@ - unsigned int len) - { - SECItem *dsasig = NULL; /* also used for ECDSA */ -- SECStatus rv = SECSuccess; - -- if ((algid != SEC_OID_ANSIX9_DSA_SIGNATURE) && -- (algid != SEC_OID_ANSIX962_EC_PUBLIC_KEY)) { -- if (sig->len != len) { -- PORT_SetError(SEC_ERROR_BAD_DER); -- return SECFailure; -+ /* Safety: Ensure algId is as expected and that signature size is within maxmimums */ -+ if (algid == SEC_OID_ANSIX9_DSA_SIGNATURE) { -+ if (len > DSA_MAX_SIGNATURE_LEN) { -+ goto loser; - } -- -- PORT_Memcpy(dsig, sig->data, sig->len); -- return SECSuccess; -- } -- -- if (algid == SEC_OID_ANSIX962_EC_PUBLIC_KEY) { -+ } else if (algid == SEC_OID_ANSIX962_EC_PUBLIC_KEY) { - if (len > MAX_ECKEY_LEN * 2) { -- PORT_SetError(SEC_ERROR_BAD_DER); -- return SECFailure; -+ goto loser; - } -- } -- dsasig = DSAU_DecodeDerSigToLen((SECItem *)sig, len); -- -- if ((dsasig == NULL) || (dsasig->len != len)) { -- rv = SECFailure; - } else { -- PORT_Memcpy(dsig, dsasig->data, dsasig->len); -+ goto loser; - } - -- if (dsasig != NULL) -+ /* Decode and pad to length */ -+ dsasig = DSAU_DecodeDerSigToLen((SECItem *)sig, len); -+ if (dsasig == NULL) { -+ goto loser; -+ } -+ if (dsasig->len != len) { - SECITEM_FreeItem(dsasig, PR_TRUE); -- if (rv == SECFailure) -- PORT_SetError(SEC_ERROR_BAD_DER); -- return rv; -+ goto loser; -+ } -+ -+ PORT_Memcpy(dsig, dsasig->data, len); -+ SECITEM_FreeItem(dsasig, PR_TRUE); -+ -+ return SECSuccess; -+ -+loser: -+ PORT_SetError(SEC_ERROR_BAD_DER); -+ return SECFailure; - } - - const SEC_ASN1Template hashParameterTemplate[] = -@@ -231,7 +262,7 @@ - sec_DecodeSigAlg(const SECKEYPublicKey *key, SECOidTag sigAlg, - const SECItem *param, SECOidTag *encalg, SECOidTag *hashalg) - { -- int len; -+ unsigned int len; - PLArenaPool *arena; - SECStatus rv; - SECItem oid; -@@ -458,48 +489,52 @@ - cx->pkcs1RSADigestInfo = NULL; - rv = SECSuccess; - if (sig) { -- switch (type) { -- case rsaKey: -- rv = recoverPKCS1DigestInfo(hashAlg, &cx->hashAlg, -- &cx->pkcs1RSADigestInfo, -- &cx->pkcs1RSADigestInfoLen, -- cx->key, -- sig, wincx); -- break; -- case rsaPssKey: -- sigLen = SECKEY_SignatureLen(key); -- if (sigLen == 0) { -- /* error set by SECKEY_SignatureLen */ -- rv = SECFailure; -+ rv = SECFailure; -+ if (type == rsaKey) { -+ rv = recoverPKCS1DigestInfo(hashAlg, &cx->hashAlg, -+ &cx->pkcs1RSADigestInfo, -+ &cx->pkcs1RSADigestInfoLen, -+ cx->key, -+ sig, wincx); -+ } else { -+ sigLen = checkedSignatureLen(key); -+ /* Check signature length is within limits */ -+ if (sigLen == 0) { -+ /* error set by checkedSignatureLen */ -+ rv = SECFailure; -+ goto loser; -+ } -+ if (sigLen > sizeof(cx->u)) { -+ PORT_SetError(SEC_ERROR_BAD_SIGNATURE); -+ rv = SECFailure; -+ goto loser; -+ } -+ switch (type) { -+ case rsaPssKey: -+ if (sig->len != sigLen) { -+ PORT_SetError(SEC_ERROR_BAD_SIGNATURE); -+ rv = SECFailure; -+ goto loser; -+ } -+ PORT_Memcpy(cx->u.buffer, sig->data, sigLen); -+ rv = SECSuccess; - break; -- } -- if (sig->len != sigLen) { -- PORT_SetError(SEC_ERROR_BAD_SIGNATURE); -- rv = SECFailure; -+ case ecKey: -+ case dsaKey: -+ /* decodeECorDSASignature will check sigLen == sig->len after padding */ -+ rv = decodeECorDSASignature(encAlg, sig, cx->u.buffer, sigLen); - break; -- } -- PORT_Memcpy(cx->u.buffer, sig->data, sigLen); -- break; -- case dsaKey: -- case ecKey: -- sigLen = SECKEY_SignatureLen(key); -- if (sigLen == 0) { -- /* error set by SECKEY_SignatureLen */ -+ default: -+ /* Unreachable */ - rv = SECFailure; -- break; -- } -- rv = decodeECorDSASignature(encAlg, sig, cx->u.buffer, sigLen); -- break; -- default: -- rv = SECFailure; -- PORT_SetError(SEC_ERROR_UNSUPPORTED_KEYALG); -- break; -+ goto loser; -+ } -+ } -+ if (rv != SECSuccess) { -+ goto loser; - } - } - -- if (rv) -- goto loser; -- - /* check hash alg again, RSA may have changed it.*/ - if (HASH_GetHashTypeByOidTag(cx->hashAlg) == HASH_AlgNULL) { - /* error set by HASH_GetHashTypeByOidTag */ -@@ -634,11 +669,16 @@ - switch (cx->key->keyType) { - case ecKey: - case dsaKey: -- dsasig.data = cx->u.buffer; -- dsasig.len = SECKEY_SignatureLen(cx->key); -+ dsasig.len = checkedSignatureLen(cx->key); - if (dsasig.len == 0) { - return SECFailure; - } -+ if (dsasig.len > sizeof(cx->u)) { -+ PORT_SetError(SEC_ERROR_BAD_SIGNATURE); -+ return SECFailure; -+ } -+ dsasig.data = cx->u.buffer; -+ - if (sig) { - rv = decodeECorDSASignature(cx->encAlg, sig, dsasig.data, - dsasig.len); -@@ -680,8 +720,13 @@ - return SECFailure; - } - rsasig.data = cx->u.buffer; -- rsasig.len = SECKEY_SignatureLen(cx->key); -+ rsasig.len = checkedSignatureLen(cx->key); - if (rsasig.len == 0) { -+ /* Error set by checkedSignatureLen */ -+ return SECFailure; -+ } -+ if (rsasig.len > sizeof(cx->u)) { -+ PORT_SetError(SEC_ERROR_BAD_SIGNATURE); - return SECFailure; - } - if (sig) { -@@ -743,7 +788,6 @@ - SECStatus rv; - VFYContext *cx; - SECItem dsasig; /* also used for ECDSA */ -- - rv = SECFailure; - - cx = vfy_CreateContext(key, sig, encAlg, hashAlg, NULL, wincx); -@@ -751,19 +795,25 @@ - switch (key->keyType) { - case rsaKey: - rv = verifyPKCS1DigestInfo(cx, digest); -+ /* Error (if any) set by verifyPKCS1DigestInfo */ - break; -- case dsaKey: - case ecKey: -+ case dsaKey: - dsasig.data = cx->u.buffer; -- dsasig.len = SECKEY_SignatureLen(cx->key); -+ dsasig.len = checkedSignatureLen(cx->key); - if (dsasig.len == 0) { -+ /* Error set by checkedSignatureLen */ -+ rv = SECFailure; - break; - } -- if (PK11_Verify(cx->key, &dsasig, (SECItem *)digest, cx->wincx) != -- SECSuccess) { -+ if (dsasig.len > sizeof(cx->u)) { -+ PORT_SetError(SEC_ERROR_BAD_SIGNATURE); -+ rv = SECFailure; -+ break; -+ } -+ rv = PK11_Verify(cx->key, &dsasig, (SECItem *)digest, cx->wincx); -+ if (rv != SECSuccess) { - PORT_SetError(SEC_ERROR_BAD_SIGNATURE); -- } else { -- rv = SECSuccess; - } - break; - default:
