Bug 430135 – Need improvement to pkix object leak testing. r=nelson

git-svn-id: svn://10.0.0.236/trunk@252415 18797224-902f-48f8-a5cc-f745e15eee43

mozilla/security/nss/lib/certhigh/certvfypkix.c

@@ -84,9 +84,6 @@ extern SECStatus
 pkix_pl_lifecycle_ObjectTableUpdate(int *objCountTable);
 
 PRInt32 parallelFnInvocationCount;
-
-PRInt32 stackErrorCodes[MAX_STACK_DEPTH]; 
-
 #endif /* PKIX_OBJECT_LEAK_TEST */
 
 
@@ -843,9 +840,6 @@ cert_PkixErrorToNssCode(
     /* Loop until we find at least one error with non-null
      * plErr code, that is going to be nss error code. */
     while (errPtr) {
-#ifdef PKIX_OBJECT_LEAK_TEST
-        stackErrorCodes[errLevel] = errPtr->errCode;
-#endif
         if (errPtr->plErr && !nssErr) {
             nssErr = errPtr->plErr;
             if (!pkixLog) break;
@@ -857,9 +851,6 @@ cert_PkixErrorToNssCode(
         errPtr = errPtr->cause;
         errLevel += 1; 
     }
-#ifdef PKIX_OBJECT_LEAK_TEST
-    stackErrorCodes[errLevel] = -1;
-#endif
     PORT_Assert(nssErr);
     if (!nssErr) {
         *pNssErr = SEC_ERROR_LIBPKIX_INTERNAL;
@@ -1178,6 +1169,7 @@ cert_VerifyCertChainPkix(
     int  objCountTable[PKIX_NUMTYPES]; 
     int  fnInvLocalCount = 0;
 
+    testStartFnStackPosition = 2;
     fnStackNameArr[0] = "cert_VerifyCertChainPkix";
     fnStackInvCountArr[0] = 0;
     PKIX_Boolean abortOnLeak = 
@@ -1284,13 +1276,11 @@ cleanup:
         pkix_pl_lifecycle_ObjectLeakCheck(leakedObjNum ? objCountTable : NULL);
     
     if (pkixLog && leakedObjNum) {
-        int level = 0;
-        PR_LOG(pkixLog, 1, ("The following error caused object leaks:\n"));
-        for(;level < MAX_STACK_DEPTH && stackErrorCodes[level] != -1;level++) {
-            PR_LOG(pkixLog, 1, ("Error at level %d: %s\n", level,
-                                PKIX_ErrorText[stackErrorCodes[level]]));
-        }
+        PR_LOG(pkixLog, 1, ("The generated error caused an object leaks. "
+                            "Stack %s\n", errorFnStackString));
     }
+    PR_Free(errorFnStackString);
+    errorFnStackString = NULL;
     if (abortOnLeak) {
         PORT_Assert(leakedObjNum == 0);
     }
@@ -2066,10 +2056,11 @@ SECStatus CERT_PKIXVerifyCert(
     int  memLeakLoopCount = 0;
     int  objCountTable[PKIX_NUMTYPES];
     int  fnInvLocalCount = 0;
+    testStartFnStackPosition = 1;
     fnStackNameArr[0] = "CERT_PKIXVerifyCert";
     fnStackInvCountArr[0] = 0;
     PKIX_Boolean abortOnLeak = 
-        PR_GetEnv("PKIX_OBJECT_LEAK_TEST_ABORT_ON_LEAK") ?
+        (PR_GetEnv("PKIX_OBJECT_LEAK_TEST_ABORT_ON_LEAK") == NULL) ?
                                                    PKIX_FALSE : PKIX_TRUE;
     runningLeakTest = PKIX_TRUE;
 
@@ -2087,8 +2078,10 @@ do {
     certSelector = NULL;
     certStores = NULL;
     valResult = NULL;
+    verifyNode = NULL;
     trustAnchor = NULL;
     trustAnchorCert = NULL;
+    builtCertList = NULL;
     oparam = NULL;
     i=0;
     errorGenerated = PKIX_FALSE;
@@ -2184,6 +2177,10 @@ do {
         goto cleanup;
     }
 
+#ifdef PKIX_OBJECT_LEAK_TEST
+    PORT_Assert(!errorGenerated);
+#endif /* PKIX_OBJECT_LEAK_TEST */
+
     oparam = cert_pkix_FindOutputParam(paramsOut, cert_po_trustAnchor);
     if (oparam != NULL) {
         oparam->value.pointer.cert = 
@@ -2210,6 +2207,9 @@ cleanup:
     if (verifyNode) {
         /* Return validation log only upon error. */
         oparam = cert_pkix_FindOutputParam(paramsOut, cert_po_errorLog);
+#ifdef PKIX_OBJECT_LEAK_TEST
+        if (!errorGenerated)
+#endif /* PKIX_OBJECT_LEAK_TEST */
         if (r && oparam != NULL) {
             PKIX_Error *tmpError =
                 cert_GetLogFromVerifyNode(oparam->value.pointer.log,
@@ -2261,14 +2261,11 @@ cleanup:
         pkix_pl_lifecycle_ObjectLeakCheck(leakedObjNum ? objCountTable : NULL);
 
     if (pkixLog && leakedObjNum) {
-        int level = 0;
-
-        PR_LOG(pkixLog, 1, ("The following error caused object leaks:\n"));
-        for(;level < MAX_STACK_DEPTH && stackErrorCodes[level] != -1;level++) {
-            PR_LOG(pkixLog, 1, ("Error at level %d: %s\n", level,
-                                PKIX_ErrorText[stackErrorCodes[level]]));
-        }
+        PR_LOG(pkixLog, 1, ("The generated error caused an object leaks. "
+                            "Stack %s\n", errorFnStackString));
     }
+    PR_Free(errorFnStackString);
+    errorFnStackString = NULL;
     if (abortOnLeak) {
         PORT_Assert(leakedObjNum == 0);
     }

mozilla/security/nss/lib/libpkix/pkix/util/pkix_tools.c

@@ -75,6 +75,8 @@ PKIX_UInt32 stackPosition;
 PKIX_UInt32 *fnStackInvCountArr;
 char **fnStackNameArr;
 PLHashTable *fnInvTable;
+PKIX_UInt32 testStartFnStackPosition;
+char *errorFnStackString;
 #endif /* PKIX_OBJECT_LEAK_TEST */
 
 /* --Private-Functions-------------------------------------------- */
@@ -1472,16 +1474,15 @@ cleanup:
 
 #ifdef PKIX_OBJECT_LEAK_TEST
 
-/* TEST_START_FN and TEST_START_FN_STACK_POS define at what state
+/* TEST_START_FN and testStartFnStackPosition define at what state
  * of the stack the object leak testing should begin. The condition
  * in pkix_CheckForGeneratedError works the following way: do leak
- * testing if at position TEST_START_FN_STACK_POS in stack array
+ * testing if at position testStartFnStackPosition in stack array
  * (fnStackNameArr) we have called function TEST_START_FN.
  * Note, that stack array get filled only when executing libpkix
  * functions.
  * */
 #define TEST_START_FN "PKIX_BuildChain"
-#define TEST_START_FN_STACK_POS 2
 
 PKIX_Error*
 pkix_CheckForGeneratedError(PKIX_StdVars * stdVars, 
@@ -1491,10 +1492,12 @@ pkix_CheckForGeneratedError(PKIX_StdVars * stdVars,
                             void * plContext)
 {
     PKIX_Error *genErr = NULL;
+    PKIX_UInt32 pos = 0;
+    PKIX_UInt32 strLen = 0;
 
     if (fnName) { 
-        if (fnStackNameArr[TEST_START_FN_STACK_POS] == NULL ||
-          strcmp(fnStackNameArr[TEST_START_FN_STACK_POS], TEST_START_FN)
+        if (fnStackNameArr[testStartFnStackPosition] == NULL ||
+            strcmp(fnStackNameArr[testStartFnStackPosition], TEST_START_FN)
             ) {
             /* return with out error if not with in boundary */
             return NULL;
@@ -1530,6 +1533,15 @@ pkix_CheckForGeneratedError(PKIX_StdVars * stdVars,
     noErrorState = PKIX_TRUE;
     genErr = PKIX_DoThrow(stdVars, errClass, PKIX_MEMLEAKGENERATEDERROR,
                           errClass, plContext);
+    while(fnStackNameArr[pos]) {
+        strLen += PORT_Strlen(fnStackNameArr[pos++]) + 1;
+    }
+    pos = 0;
+    errorFnStackString = PORT_ZAlloc(strLen);
+    while(fnStackNameArr[pos]) {
+        strcat(errorFnStackString, "/");
+        strcat(errorFnStackString, fnStackNameArr[pos++]);
+    }
     noErrorState = PKIX_FALSE;
     
     return genErr;

mozilla/security/nss/lib/libpkix/pkix/util/pkix_tools.h

@@ -185,6 +185,8 @@ extern PKIX_Boolean noErrorState;
 extern PKIX_Boolean errorGenerated;
 extern PKIX_Boolean runningLeakTest;
 extern PLHashTable *fnInvTable;
+extern PKIX_UInt32 testStartFnStackPosition;
+extern char *errorFnStackString;
 
 extern PLHashNumber PR_CALLBACK pkix_ErrorGen_Hash (const void *key);
 

mozilla/security/nss/tests/iopr/cert_iopr.sh

@@ -123,6 +123,8 @@ download_file() {
     echo "GET $filePath HTTP/1.0" > $req
     echo >> $req
 
+    echo ${BINDIR}/tstclnt -d $trgDir -S -h $host -p $IOPR_DOWNLOAD_PORT \
+        -w ${R_PWFILE} -o 
     ${BINDIR}/tstclnt -d $trgDir -S -h $host -p $IOPR_DOWNLOAD_PORT \
         -w ${R_PWFILE} -o < $req > $file
     ret=$?

mozilla/security/nss/tests/libpkix/cert_trust.map

@@ -1,3 +1,6 @@
 TestCA.ca CT,C,C
 TestUser50 ,,
 TestUser51 ,,
+PayPalRootCA CT,C,C
+PayPalICA ,,
+PayPalEE ,,

mozilla/security/nss/tests/libpkix/libpkix.sh

@@ -236,7 +236,7 @@ libpkix_leak_test()
     fi 
     while read status leafCert explPolicy others; do
         # continue with empty and commented lines. 
-        [ -z "$status" -o "$status" = "#" ] && continue
+        [ -z "$status" -o "`echo $status | cut -c 1`" = "#" ] && continue
 
         # can only run positive tests. Positive validation
         # status is the exit condition for the code in the library.

mozilla/security/nss/tests/libpkix/vfychain_test.lst

@@ -1,4 +1,4 @@
 # Status | Leaf Cert | Policies | Others(undef)
 0 TestUser50 undef
 0 TestUser51 undef
-
+0 PayPalEE OID.2.16.840.1.113733.1.7.23.6