From b9d0822fe3e7d26b12346fbc8d2970ce544aa77d Mon Sep 17 00:00:00 2001
From: "wtchang%redhat.com"
 <wtchang%redhat.com@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Wed, 6 Dec 2006 02:25:52 +0000
Subject: [PATCH] Bugzilla Bug 357197: when we compare hash algorithm
 identifiers, allow the 'parameters' to be either NULL or missing. 
 r=nelsonb,relyea

git-svn-id: svn://10.0.0.236/trunk@216531 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/security/nss/lib/certhigh/ocsp.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/mozilla/security/nss/lib/certhigh/ocsp.c b/mozilla/security/nss/lib/certhigh/ocsp.c
index 922fd591bb4..ef2e7921fda 100644
--- a/mozilla/security/nss/lib/certhigh/ocsp.c
+++ b/mozilla/security/nss/lib/certhigh/ocsp.c
@@ -38,7 +38,7 @@
  * Implementation of OCSP services, for both client and server.
  * (XXX, really, mostly just for client right now, but intended to do both.)
  *
- * $Id: ocsp.c,v 1.30 2006-11-13 18:16:58 wtchang%redhat.com Exp $
+ * $Id: ocsp.c,v 1.31 2006-12-06 02:25:52 wtchang%redhat.com Exp $
  */
 
 #include "prerror.h"
@@ -2832,8 +2832,14 @@ ocsp_CertIDsMatch(CERTCertDBHandle *handle,
 	goto done;
     }
 
-    if (SECOID_CompareAlgorithmID(&certID1->hashAlgorithm,
-				  &certID2->hashAlgorithm) == SECEqual) {
+    /*
+     * For all the supported hash algorithms, 'parameters' is NULL (two
+     * bytes 0x05 0x00), but we allow it to be missing (zero length).
+     */
+    if ((SECITEM_CompareItem(&certID1->hashAlgorithm.algorithm,
+			     &certID2->hashAlgorithm.algorithm) == SECEqual)
+      && (certID1->hashAlgorithm.parameters.len <= 2)
+      && (certID2->hashAlgorithm.parameters.len <= 2)) {
 	/*
 	 * If the hash algorithms match then we can do a simple compare
 	 * of the hash values themselves.