diff options
| author | J.C. Jones <jjones@mozilla.com> | 2020-08-29 13:04:08 +0000 |
|---|---|---|
| committer | Moonchild <moonchild@palemoon.org> | 2020-08-29 13:04:08 +0000 |
| commit | 58cc431b02c14e4a489a0ebcbacd8d491217c3c3 (patch) | |
| tree | a30058d6dd4b04880d4105ab31c84a3a723ed757 | |
| parent | 5559674becdb441a02fb0438de20bbc9ca5b97a7 (diff) | |
| download | UXP-58cc431b02c14e4a489a0ebcbacd8d491217c3c3.tar UXP-58cc431b02c14e4a489a0ebcbacd8d491217c3c3.tar.gz UXP-58cc431b02c14e4a489a0ebcbacd8d491217c3c3.tar.lz UXP-58cc431b02c14e4a489a0ebcbacd8d491217c3c3.tar.xz UXP-58cc431b02c14e4a489a0ebcbacd8d491217c3c3.zip | |
[NSS] Prevent slotLock race in NSC_GetTokenInfo
Basically, NSC_GetTokenInfo doesn't lock slot->slotLock before accessing slot
after obtaining it, even though slotLock is defined as its lock.
| -rw-r--r-- | security/nss/lib/softoken/pkcs11.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/security/nss/lib/softoken/pkcs11.c b/security/nss/lib/softoken/pkcs11.c index 6c535cf77..116a34890 100644 --- a/security/nss/lib/softoken/pkcs11.c +++ b/security/nss/lib/softoken/pkcs11.c @@ -3511,10 +3511,12 @@ NSC_GetTokenInfo(CK_SLOT_ID slotID, CK_TOKEN_INFO_PTR pInfo) PORT_Memcpy(pInfo->model, "NSS 3 ", 16); PORT_Memcpy(pInfo->serialNumber, "0000000000000000", 16); PORT_Memcpy(pInfo->utcTime, "0000000000000000", 16); - pInfo->ulMaxSessionCount = 0; /* arbitrarily large */ + pInfo->ulMaxSessionCount = 0; /* arbitrarily large */ + pInfo->ulMaxRwSessionCount = 0; /* arbitrarily large */ + PZ_Lock(slot->slotLock); /* Protect sessionCount / rwSessioncount */ pInfo->ulSessionCount = slot->sessionCount; - pInfo->ulMaxRwSessionCount = 0; /* arbitarily large */ pInfo->ulRwSessionCount = slot->rwSessionCount; + PZ_Unlock(slot->slotLock); /* Unlock before sftk_getKeyDB */ pInfo->firmwareVersion.major = 0; pInfo->firmwareVersion.minor = 0; PORT_Memcpy(pInfo->label, slot->tokDescription, sizeof(pInfo->label)); |