Bug 1334049 - fix negative left shift, r=ttaubert
authorFranziskus Kiefer <franziskuskiefer@gmail.com>
Wed, 25 Jan 2017 15:36:29 +0100
changeset 13064 4c15f6a36721536a8a6eb2f42823f88a79f29c23
parent 13063 391e604c7e0127f79c269d9b8f4f329c5dd34782
child 13065 4b594ee73b360dbb2489f0246025424f75b36728
push id1961
push userfranziskuskiefer@gmail.com
push dateThu, 26 Jan 2017 08:36:16 +0000
reviewersttaubert
bugs1334049
Bug 1334049 - fix negative left shift, r=ttaubert Differential Revision: https://nss-review.dev.mozaws.net/D173
lib/certdb/alg1485.c
--- a/lib/certdb/alg1485.c
+++ b/lib/certdb/alg1485.c
@@ -336,23 +336,26 @@ hexToBin(PLArenaPool* pool, SECItem* des
 {
     PRUint8* dest;
 
     destItem->data = NULL;
     if (len <= 0 || (len & 1)) {
         goto loser;
     }
     len >>= 1;
-    if (!SECITEM_AllocItem(pool, destItem, len))
+    if (!SECITEM_AllocItem(pool, destItem, len)) {
         goto loser;
+    }
     dest = destItem->data;
     for (; len > 0; len--, src += 2) {
-        PRInt16 bin = (x2b[(PRUint8)src[0]] << 4) | x2b[(PRUint8)src[1]];
-        if (bin < 0)
+        PRUint16 bin = ((PRUint16)x2b[(PRUint8)src[0]] << 4);
+        bin |= (PRUint16)x2b[(PRUint8)src[1]];
+        if (bin >> 15) { /* is negative */
             goto loser;
+        }
         *dest++ = (PRUint8)bin;
     }
     return SECSuccess;
 loser:
     if (!pool)
         SECITEM_FreeItem(destItem, PR_FALSE);
     return SECFailure;
 }