Stephan Bergmann
9cd7ef2e7e
Ever since 879668c9ba "MOZILLA_CERTIFICATE_FOLDER
needs to be non-empty to disable autodetect..." we have in
engine/solenv/gbuild/gbuild.mk:
> # * Disable searching for certificates by default:
> #
> # see xmlsecurity/source/xmlsec/nss/nssinitializer.cxx for use
> #
> # a) If MOZILLA_CERTIFICATE_FOLDER is empty then LibreOffice autodetects
> # the user's mozilla-descended application profile. To disable that we
> # use a non-empty string here.
> #
> # b) Using dbm: appears to nss as equivalent to an empty path so the
> # initial NSS_InitReadWrite will fail. In response to that failure
> # LibreOffice will create a temp fallback cert database which is removed
> # on process exit
> gb_TEST_ENV_VARS += MOZILLA_CERTIFICATE_FOLDER=dbm:
Which leads to a call of NSS_InitReadWrite("dbm:") in nsscrypto_initialize
(engine/xmlsecurity/source/xmlsec/nss/nssinitializer.cxx), which reaches
nss_Init, which recognizes the "dbm:" prefix and strips it, leaving an empty
config directory. If no root certificate module is loaded yet
(SECMOD_HasRootCerts() is false, which is the case in an environment that has no
NSS root certs) nss_Init then calls nss_FindExternalRoot with that empty path,
causing an out-of-bounds read of path[-1] at
> if (path[path_len - 1] != FILE_SEP)
Signed-off-by: Stephan Bergmann <stephan.bergmann@collabora.com>
Change-Id: I45d8cbc236b47f6fbf082e5d48bd99abda71e7f0
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/4138
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit 0cc0fa8ea35441d752aa601921d800c9e479b823)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/206355
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Contains the Network Security Services (NSS) libraries from Mozilla == ESR versions == Upstream releases both regular and "ESR" versions, the latter go into Firefox ESR and Thunderbird. There is a new ESR version about once a year, and a ESR version gets micro updates only when there are security issues to fix, and it's not always obvious from the release notes of a regular release if there are security issues that are relevant to LibreOffice, hence it's probably best to bundle only the ESR versions and upgrade for every micro release (as recommended by upstream). == Fips 140 and signed libraries == Fips 140 mode is not supported. That is, the *.chk files containing the checksums for the cryptographic module are not delivered into instdir and will not be part of the OOo installation sets. Signing has been turned off because - we change the rpath (install names) after signing which breaks the signatures (Mac) - sqlite conflicts with the system sqlite when signing which breaks the build See also [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_Tech_Notes/nss_tech_note6] == libsqlite3 == With all supported macOS SDK we use NSS_USE_SYSTEM_SQLITE=1 to build using the system sqlite.