Moonchild
0e521f6302
Bump NSS (UXP) patch level.
2026-07-28 10:10:27 +02:00
John Schanck
21ad7adc90
Bug 2043887 - guard against integer overflow in CERT_Hexify.
2026-07-28 10:03:44 +02:00
Benjamin Beurdouche
9a29430751
Bug 2027353 - clamp input.len to testString size in pk11_mergeSecretKey.
2026-07-28 09:59:51 +02:00
Benjamin Beurdouche
481d4868b0
Bug 2029433 - Bounds-check wrap index in PK11_GetWrapKey to match PK11_SetWrapKey.
2026-07-28 09:57:10 +02:00
Anna Weine
d148c11717
Bug 2028954 - CERT_DecodeAVAValue — Integer Overflow in Output Buffer Sizing.
2026-07-28 09:53:26 +02:00
Moonchild
bc322e58f8
Bug 2027364 - Set tail pointer to null in static slot lists when deallocating.
2026-07-28 09:22:56 +02:00
John Schanck
e48a6f26a5
Bug 2032110 - fix two integer overflows on LLP64 systems.
2026-07-27 23:58:14 +02:00
John Schanck
d85edd01df
Bug 2030102 - avoid leaving a dangling ss->sec.ci.sid on allocation failure.
2026-07-27 23:49:55 +02:00
Maurice Dauer
296379d751
Bug 2027325 - Reject empty nickname in PK11_TraverseCertsForNicknameInSlot.
2026-07-27 23:46:32 +02:00
Moonchild
7ba9fc2801
Bug 2030563 - Validate CKA_CERTIFICATE_TYPE ulValueLen in nss_cert_type_from_ck_attrib.
2026-07-27 23:22:58 +02:00
Benjamin Beurdouche
71c0f8246c
Bug 2029807 - Guard padding read against empty output in SEC_PKCS7DecryptContents.
2026-07-27 19:12:42 +02:00
Benjamin Beurdouche
6cda35442f
Bug 2027346 - validate encoded EC params length and tag in SECKEY_ECParamsToKeySize/BasePointOrderLen.
2026-07-27 19:05:33 +02:00
Benjamin Beurdouche
1dba423327
Bug 2027371 - rewrite labelLen bound in tls13_HkdfExpandLabelGeneral to avoid unsigned overflow.
2026-07-27 18:56:08 +02:00
Benjamin Beurdouche
e2af0b28bf
Bug 2027373 - guard space subtraction in ssl_CallCustomExtensionSenders.
2026-07-27 18:51:32 +02:00
Benjamin Beurdouche
5ea9b7b80a
Bug 2029901 - Guard against keySize overflow in IKE PRF/PRF+ output sizing.
2026-07-27 18:44:55 +02:00
Benjamin Beurdouche
b799e100ad
Bug 2027362 - bound usageCount in PK11_UnwrapPrivKey to keyTemplate capacity.
2026-07-27 18:39:10 +02:00
Benjamin Beurdouche
1c500a6abb
Bug 2027349 - reject empty nickname in PK11_TraverseCertsForNicknameInSlot.
2026-07-27 18:27:47 +02:00
Moonchild
7b3d961465
Bump NSS version for adopted changes.
2026-06-19 14:19:43 +02:00
John Schanck
f6c9c0c59f
Bug 2030564 - add defensive input validation to sftk_compute_ANSI_X9_63_kdf.
2026-06-19 12:56:26 +02:00
John Schanck
d8c9d24a9c
Bug 2030366 - avoid race with module unloading in NSSTrustDomain_FindTokensByURI.
2026-06-19 12:04:23 +02:00
John Schanck
a466b73267
Bug 2029403 - avoid PORT_Strdup in ssl_DecodeResumptionToken.
2026-06-19 10:51:37 +02:00
John Schanck
d5bf2555a3
Bug 2023478 - improve handling of escape sequences in pk11uri_ParseAttributes.
2026-06-17 12:17:06 +02:00
John Schanck
746a7be08c
Bug 2030570 - use correct data for ID comparison in transfer_uri_certs_to_collection.
2026-06-16 19:54:44 +02:00
John Schanck
4950bd038d
Bug 2029765 - avoid refcount over-release in nssTokenObjectCache error path [@ nssToken_Destroy].
2026-06-16 18:52:25 +02:00
John Schanck
6823388a85
Bug 2029803 - add defensive info->len check in PK11_HPKE_SetupS and PK11_HPKE_SetupR.
2026-06-16 09:27:28 +02:00
Moonchild
a0f135b94f
NSS version update
2026-05-26 14:16:25 +02:00
John Schanck
f9cdc54e09
Bug 2029818 - avoid refcount over-release in CERT_CertChainFromCert error path.
2026-05-25 10:22:44 +02:00
Moonchild
28be7ae6e0
[NSS] Fix use of uninitialized length after failed PK11_SignWithMechanism/SymKey.
2026-05-25 07:27:51 +02:00
John Schanck
531eeaabaa
[NSS] Fix maxSize calculation in NSSUTIL_AddNSSFlagToModuleSpec.
2026-05-25 06:43:53 +02:00
John Schanck
5005a47921
Bug 2027381 - improve error handling in SECITEM_DupArray with non-null arena.
2026-05-24 22:30:38 +02:00
John Schanck
c87c0e440b
Bug 2029782 - fix 8-byte over-read of AES-192 key buffer in x86 builds without USE_HW_AES.
2026-05-24 15:10:06 +02:00
John Schanck
39b34ed8c5
Bug 2029771 - Heap use-after-free in [@ token_destructor] reading tok->pk11slot after nssToken_Destroy frees the token arena.
2026-05-24 15:07:24 +02:00
John Schanck
e6b4a84e7e
[NSS] Avoid integer overflow when converting AVA value to hex string.
2026-05-24 15:03:12 +02:00
John Schanck
f7dfc278c4
[NSS] Enforce minimum buffer length in sftk_CheckCBCPadding.
2026-05-24 14:58:53 +02:00
Dana Keeler
13349f484c
[NSS] VerifyCodeSigningCertificateChain: require at least one certificate.
2026-05-24 14:40:56 +02:00
Moonchild
bd2670e006
[NSS] Initialize src in SEC_PKCS5GetIV
2026-05-24 14:37:06 +02:00
Dana Keeler
e5bebae2c7
[NSS] NSS_CMSContentInfo_SetContent: only modify cinfo if everything succeeds.
2026-05-24 12:03:33 +02:00
Dennis Jackson
d93df7216d
[NSS] Align PKCS7 digest array with digestAlgorithms.
2026-05-24 11:50:38 +02:00
John Schanck
fdde68855b
[NSS] Handle SEC_ASN1_NULL in sec_asn1e_contents_length.
2026-05-24 10:16:24 +02:00
Moonchild
2d038e6c1a
[NSS] Fix instances of softoken attributes freed after owning object.
2026-05-24 10:09:28 +02:00
nia
4a9d702bc1
Add NetBSD to list of platforms where mapfile gets generated
...
Signed-off-by: Nia Alarie <nia@NetBSD.org >
2026-05-20 10:26:38 +02:00
Moonchild
6dcb20949a
[NSS] Restore dropped 'S' :P
2026-04-27 16:36:01 +02:00
Moonchild
e051599073
[NSS] Update NSS version for release.
...
Add (UXP) to the version display string to signify this is our variant of
NSS 3.90 to avoid confusion with the 3.90 branch used in Firefox 115 ESR.
This version has backported considerably more fixes than Mozilla's NSS.
2026-04-26 15:44:48 +02:00
Dennis Jackson
2729d6cae9
Bug 2029323 - Improve size calculations in CMS content buffering
2026-04-26 10:31:29 +02:00
John Schanck
da3b8fc623
Bug 2029425 - Heap use-after-free in cert_VerifyCertChainOld via dangling certsList[] entry on NameConstraints violation.
2026-04-26 10:27:35 +02:00
John Schanck
867bd1549b
Bug 2030135 - improve error handling in PK11_ImportPrivateKeyInfoAndReturnKey
2026-04-26 09:18:06 +02:00
John Schanck
c04c33e327
Bug 2029462 - store email on subject cache_entry in NSS trust domain.
...
remove_email_entry used cert->email of the last-destroyed cert to locate
the hash entry to clean up. If that cert had no email, the entry was
silently skipped, leaving a dangling subjectList pointer after the arena
was freed. Store the registration-time email on the subject cache_entry
(mirroring ce->nickname) and thread it through remove_subject_entry so
removal always uses the correct email regardless of destruction order.
2026-04-25 22:59:08 +02:00
Moonchild
a64033be06
[security] Ensure DispatchToMainThreadAndWait isn't interrupted.
...
In some cases, `lock.wait()` can be interrupted by spurious wake-ups
before processing is done. To ensure things are, in fact, synchronous,
loop over `wait()` until it is actually done.
2026-04-25 17:17:08 +02:00
Dennis Jackson
84a3ff050c
[NSS] Clarify extension negotiation mechanism for TLS Handshakes.
2026-04-25 14:14:21 +02:00
Moonchild
4f8122c97c
[NSS] Deep copy profile data in CERT_FindSMimeProfile.
2026-04-25 08:52:27 +02:00
Moonchild
John Schanck
Benjamin Beurdouche
Anna Weine
Maurice Dauer
Dana Keeler
Dennis Jackson
nia