diff --git a/mozilla/security/nss/lib/freebl/hmacct.c b/mozilla/security/nss/lib/freebl/hmacct.c
index cdb7300a573..9cf04f88e8b 100644
--- a/mozilla/security/nss/lib/freebl/hmacct.c
+++ b/mozilla/security/nss/lib/freebl/hmacct.c
@@ -172,8 +172,16 @@ static SECStatus mac(
     if (mdLengthSize == 16) {
 	j = 8;
     }
-    for (i = 0; i < 4; i++) {
-	lengthBytes[4+i+j] = bits >> (8*(7-i));
+    if (hashObj->type == HASH_AlgMD5) {
+	/* MD5 appends a little-endian length. */
+	for (i = 0; i < 4; i++) {
+	    lengthBytes[i+j] = bits >> (8*i);
+	}
+    } else {
+	/* All other TLS hash functions use a big-endian length. */
+	for (i = 0; i < 4; i++) {
+	    lengthBytes[4+i+j] = bits >> (8*(7-i));
+	}
     }
 
     if (k > 0) {
diff --git a/mozilla/security/nss/lib/softoken/sftkhmac.c b/mozilla/security/nss/lib/softoken/sftkhmac.c
index 412ee4dc417..04b325b4b4b 100644
--- a/mozilla/security/nss/lib/softoken/sftkhmac.c
+++ b/mozilla/security/nss/lib/softoken/sftkhmac.c
@@ -106,7 +106,7 @@ sftk_MACConstantTimeCtx* sftk_SSLv3MACConstantTime_New(CK_MECHANISM_PTR mech,
 	return NULL;
     }
 
-    if (params->hashAlg == CKM_MD5) {
+    if (params->hashAlg == CKM_SSL3_MD5_MAC) {
 	padLength = 48;
     }
 
diff --git a/mozilla/security/nss/lib/ssl/ssl3con.c b/mozilla/security/nss/lib/ssl/ssl3con.c
index 8d282fc82c0..49526aca586 100644
--- a/mozilla/security/nss/lib/ssl/ssl3con.c
+++ b/mozilla/security/nss/lib/ssl/ssl3con.c
@@ -5,7 +5,7 @@
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-/* $Id: ssl3con.c,v 1.198 2013-02-05 18:10:45 wtc%google.com Exp $ */
+/* $Id: ssl3con.c,v 1.199 2013-02-06 02:02:38 wtc%google.com Exp $ */
 
 /* TODO(ekr): Implement HelloVerifyRequest on server side. OK for now. */
 
@@ -2063,12 +2063,6 @@ ssl3_ComputeRecordMACConstantTime(
 	goto fallback;
     }
 
-    if (spec->cipher_def->cipher == cipher_rc2_40) {
-	/* This function doesn't work for SSL3_RSA_EXPORT_WITH_RC2_CBC_40_MD5.
-	 * We fallback on the non-constant time version. */
-	goto fallback;
-    }
-
     if (spec->mac_def->mac == mac_null) {
 	*outLen = 0;
 	return SECSuccess;