From b53400eb05ac0b0f84cbf764c4347d652f884cf8 Mon Sep 17 00:00:00 2001 From: "wtc%google.com" Date: Sun, 27 Jan 2008 06:04:54 +0000 Subject: [PATCH] Bug 403910: if the cert we found by nickname meets the requirements, CERT_FindUserCertByUsage should just return it. The patch is contributed by Angelo Rosenfelder . r=wtc,relyea git-svn-id: svn://10.0.0.236/trunk@244124 18797224-902f-48f8-a5cc-f745e15eee43 --- mozilla/security/nss/lib/certhigh/certhigh.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/mozilla/security/nss/lib/certhigh/certhigh.c b/mozilla/security/nss/lib/certhigh/certhigh.c index 17a86de7d5d..6f4963f7eba 100644 --- a/mozilla/security/nss/lib/certhigh/certhigh.c +++ b/mozilla/security/nss/lib/certhigh/certhigh.c @@ -282,6 +282,26 @@ CERT_FindUserCertByUsage(CERTCertDBHandle *handle, } if ( cert != NULL ) { + unsigned int requiredKeyUsage; + unsigned int requiredCertType; + + rv = CERT_KeyUsageAndTypeForCertUsage(usage, PR_FALSE, + &requiredKeyUsage, &requiredCertType); + if ( rv != SECSuccess ) { + /* drop the extra reference */ + CERT_DestroyCertificate(cert); + cert = NULL; + goto loser; + } + /* If we already found the right cert, just return it */ + if ( (!validOnly || CERT_CheckCertValidTimes(cert, time, PR_FALSE) + == secCertTimeValid) && + (CERT_CheckKeyUsage(cert, requiredKeyUsage) == SECSuccess) && + (cert->nsCertType & requiredCertType) && + CERT_IsUserCert(cert) ) { + return(cert); + } + /* collect certs for this nickname, sorting them into the list */ certList = CERT_CreateSubjectCertList(certList, handle, &cert->derSubject, time, validOnly);