Fix creation of NativeProxy

Resolves: rhbz#1766451

Signed-off-by: Alexander Scheel <ascheel@redhat.com>

.gitignore

@@ -1,3 +1,10 @@
+# Local build files
+jss-*.src.rpm
+jss-*/
+x86_64/
+.build-*.log
+
+# Releases
 jss-4.2.6.tar.gz
 /jss-4.2.6.tar.gz
 /jss-4.4.0.tar.gz
@@ -11,3 +18,8 @@ jss-4.2.6.tar.gz
 /jss-4.5.0-a4.tar.gz
 /jss-4.5.0-b1.tar.gz
 /jss-4.5.0.tar.gz
+/jss-4.5.1.tar.gz
+/jss-4.5.2.tar.gz
+/jss-4.5.3.tar.gz
+/jss-4.6.1.tar.gz
+/jss-4.6.2.tar.gz

0001-Fix-NativeProxy-reference-tracker.patch

@@ -0,0 +1,53 @@
+From 91514ca0a2979ba778d27220ced0cd312e2cd2d2 Mon Sep 17 00:00:00 2001
+From: Alexander Scheel <ascheel@redhat.com>
+Date: Tue, 29 Oct 2019 10:43:56 -0400
+Subject: [PATCH] Fix NativeProxy reference tracker
+
+In eb5df01003d74b57473eacb84e538d31f5bb06ca, I introduced a bug by
+setting mPointer after trying to add NativeProxy to the registry. In
+most instances this won't matter, however, if another instance exists in
+the HashSet with the same hash value, the equals comparator will be
+used, triggering a NPE.
+
+Signed-off-by: Alexander Scheel <ascheel@redhat.com>
+---
+ org/mozilla/jss/util/NativeProxy.java | 13 +++++--------
+ 1 file changed, 5 insertions(+), 8 deletions(-)
+
+diff --git a/org/mozilla/jss/util/NativeProxy.java b/org/mozilla/jss/util/NativeProxy.java
+index 1c6d1aa5..a0811f76 100644
+--- a/org/mozilla/jss/util/NativeProxy.java
++++ b/org/mozilla/jss/util/NativeProxy.java
+@@ -40,8 +40,8 @@ public abstract class NativeProxy implements AutoCloseable
+      */
+     public NativeProxy(byte[] pointer) {
+ 		assert(pointer!=null);
+-        registry.add(this);
+         mPointer = pointer;
++        registry.add(this);
+ 
+         if (saveStacktraces) {
+             mTrace = Arrays.toString(Thread.currentThread().getStackTrace());
+@@ -61,15 +61,12 @@ public abstract class NativeProxy implements AutoCloseable
+         if( ! (obj instanceof NativeProxy) ) {
+             return false;
+         }
+-        if( ((NativeProxy)obj).mPointer.length != mPointer.length) {
++        if (((NativeProxy)obj).mPointer == null) {
++            /* If mPointer is null, we have no way to compare the values
++             * of the pointers, so assume they're unequal. */
+             return false;
+         }
+-        for(int i=0; i < mPointer.length; i++) {
+-            if(mPointer[i] != ((NativeProxy)obj).mPointer[i]) {
+-                return false;
+-            }
+-        }
+-        return true;
++        return Arrays.equals(((NativeProxy)obj).mPointer, mPointer);
+     }
+ 
+     /**
+-- 
+2.21.0
+

jss.spec

@@ -6,18 +6,17 @@ Summary:        Java Security Services (JSS)
 URL:            http://www.dogtagpki.org/wiki/JSS
 License:        MPLv1.1 or GPLv2+ or LGPLv2+
 
-Version:        4.5.0
-Release:        1%{?_timestamp}%{?_commit_id}%{?dist}
+Version:        4.6.2
+Release:        2%{?_timestamp}%{?_commit_id}%{?dist}
 # global         _phase -a1
 
 # To generate the source tarball:
 # $ git clone https://github.com/dogtagpki/jss.git
 # $ cd jss
-# $ git archive \
-#     --format=tar.gz \
-#     --prefix jss-VERSION/ \
-#     -o jss-VERSION.tar.gz \
-#     <version tag>
+# $ git tag v4.5.<z>
+# $ git push origin v4.5.<z>
+# Then go to https://github.com/dogtagpki/jss/releases and download the source
+# tarball.
 Source:         https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phase}/%{name}-%{version}%{?_phase}.tar.gz
 
 # To create a patch for all changes since a version tag:
@@ -26,6 +25,7 @@ Source:         https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas
 #     <version tag> \
 #     > jss-VERSION-RELEASE.patch
 # Patch: jss-VERSION-RELEASE.patch
+Patch: 0001-Fix-NativeProxy-reference-tracker.patch
 
 ################################################################################
 # Build Dependencies
@@ -33,14 +33,17 @@ Source:         https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas
 
 # autosetup
 BuildRequires:  git
+BuildRequires:  make
+BuildRequires:  cmake
 
 BuildRequires:  gcc-c++
 BuildRequires:  nspr-devel >= 4.13.1
-BuildRequires:  nss-devel >= 3.28.4-6
-BuildRequires:  nss-tools >= 3.28.4-6
+BuildRequires:  nss-devel >= 3.30
+BuildRequires:  nss-tools >= 3.30
 BuildRequires:  java-devel
 BuildRequires:  jpackage-utils
 BuildRequires:  slf4j
+BuildRequires:  glassfish-jaxb-api
 %if 0%{?rhel} && 0%{?rhel} <= 7
 # no slf4j-jdk14
 %else
@@ -49,14 +52,13 @@ BuildRequires:  slf4j-jdk14
 BuildRequires:  apache-commons-lang
 BuildRequires:  apache-commons-codec
 
-%if 0%{?fedora} >= 25 || 0%{?rhel} > 7
-BuildRequires:  perl-interpreter
-%endif
+BuildRequires:  junit
 
-Requires:       nss >= 3.28.4-6
+Requires:       nss >= 3.30
 Requires:       java-headless
 Requires:       jpackage-utils
 Requires:       slf4j
+Requires:       glassfish-jaxb-api
 %if 0%{?rhel} && 0%{?rhel} <= 7
 # no slf4j-jdk14
 %else
@@ -97,43 +99,27 @@ This package contains the API documentation for JSS.
 %set_build_flags
 
 [ -z "$JAVA_HOME" ] && export JAVA_HOME=%{_jvmdir}/java
-[ -z "$USE_INSTALLED_NSPR" ] && export USE_INSTALLED_NSPR=1
-[ -z "$USE_INSTALLED_NSS" ] && export USE_INSTALLED_NSS=1
 
 # Enable compiler optimizations
 export BUILD_OPT=1
 
 # Generate symbolic info for debuggers
-XCFLAGS="-g $RPM_OPT_FLAGS"
-export XCFLAGS
+CFLAGS="-g $RPM_OPT_FLAGS"
+export CFLAGS
 
-PKG_CONFIG_ALLOW_SYSTEM_LIBS=1
-PKG_CONFIG_ALLOW_SYSTEM_CFLAGS=1
-
-export PKG_CONFIG_ALLOW_SYSTEM_LIBS
-export PKG_CONFIG_ALLOW_SYSTEM_CFLAGS
-
-NSPR_INCLUDE_DIR=`/usr/bin/pkg-config --cflags-only-I nspr | sed 's/-I//'`
-NSPR_LIB_DIR=`/usr/bin/pkg-config --libs-only-L nspr | sed 's/-L//'`
-
-NSS_INCLUDE_DIR=`/usr/bin/pkg-config --cflags-only-I nss | sed 's/-I//'`
-NSS_LIB_DIR=`/usr/bin/pkg-config --libs-only-L nss | sed 's/-L//'`
-
-export NSPR_INCLUDE_DIR
-export NSPR_LIB_DIR
-export NSS_INCLUDE_DIR
-export NSS_LIB_DIR
-
-%if 0%{?__isa_bits} == 64
-USE_64=1
-export USE_64
-%endif
+# Check if we're in FIPS mode
+modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENABLED=1
 
 # The Makefile is not thread-safe
-make -C coreconf
-make
-make javadoc
-make test_jss
+rm -rf build && mkdir -p build && cd build
+%cmake \
+    -DJAVA_HOME=%{java_home} \
+    -DJAVA_LIB_INSTALL_DIR=%{_jnidir} \
+    ..
+
+%{__make} all
+%{__make} javadoc || true
+ctest --output-on-failure
 
 ################################################################################
 %install
@@ -142,19 +128,19 @@ make test_jss
 
 # jars
 install -d -m 0755 $RPM_BUILD_ROOT%{_jnidir}
-install -m 644 ../dist/xpclass.jar ${RPM_BUILD_ROOT}%{_jnidir}/jss4.jar
+install -m 644 build/jss4.jar ${RPM_BUILD_ROOT}%{_jnidir}/jss4.jar
 
 # We have to use the name libjss4.so because this is dynamically
 # loaded by the jar file.
 install -d -m 0755 $RPM_BUILD_ROOT%{_libdir}/jss
-install -m 0755 ../dist/Linux*.OBJ/lib/libjss4.so ${RPM_BUILD_ROOT}%{_libdir}/jss/
+install -m 0755 build/libjss4.so ${RPM_BUILD_ROOT}%{_libdir}/jss/
 pushd  ${RPM_BUILD_ROOT}%{_libdir}/jss
     ln -fs %{_jnidir}/jss4.jar jss4.jar
 popd
 
 # javadoc
 install -d -m 0755 $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version}
-cp -rp ../dist/jssdoc/* $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version}
+cp -rp build/docs/* $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version}
 cp -p jss.html $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version}
 cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version}
 
@@ -175,6 +161,36 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version}
 
 ################################################################################
 %changelog
+* Tue Oct 29 2019 Dogtag PKI Team <pki-devel@redhat.com> - 4.6.2-2
+- Fix for rhbz#1766451
+
+* Tue Oct 15 2019 Dogtag PKI Team <pki-devel@redhat.com> - 4.6.2-1
+- Rebase to JSS 4.6.2
+- Fixes CVE-2019-14823
+
+* Thu Aug 08 2019 Dogtag PKI Team <pki-devel@redhat.com> - 4.6.1-2
+- Disable unnecessary tests to fix broken s390x
+
+* Thu Aug 08 2019 Dogtag PKI Team <pki-devel@redhat.com> - 4.6.1-1
+- Rebase to JSS 4.6.1
+
+* Mon May 06 2019 Dogtag PKI Team <pki-devel@redhat.com> - 4.5.3-2
+- Add AIA OCSP certificate checking patch
+
+* Tue Mar 19 2019 Dogtag PKI Team <pki-devel@redhat.com> - 4.5.3-1
+- Rebase to JSS 4.5.3
+
+* Fri Feb 01 2019 Dogtag PKI Team <pki-devel@redhat.com> - 4.5.2-3
+- Include nuxwdog patch for netscape.security.util.Utils from PKI
+
+* Mon Jan 14 2019 Dogtag PKI Team <pki-devel@redhat.com> 4.5.2-1
+- Rebased to JSS 4.5.2
+
+* Thu Nov 29 2018 Dogtag PKI Team <pki-devel@redhat.com> 4.5.1-1
+- Rebased to JSS 4.5.1
+- Red Hat Bugzilla #1582323 - DER encoding error for enumerated types with a value of zero
+- Red Hat Bugzilla #1534765 - javadoc for org.mozilla.jss.pkix.cms.SignedData.getSignerInfos() is incorrect
+
 * Fri Aug 10 2018 Dogtag PKI Team <pki-devel@redhat.com> 4.5.0-1
 - Rebased to JSS 4.5.0
 

sources

@@ -1 +1 @@
-SHA512 (jss-4.5.0.tar.gz) = abebd75104f747a95dc3160dc6218c549235f5c9ee2d416299bfe132072b76fb7f0fec4ce2664931bf971280836ab0eb26746f964c13300393fa6a5937f81cda
+SHA512 (jss-4.6.2.tar.gz) = 53c12822b980f6dcaf5616366834fe4eaee07d84feae53096aa0ea142146e90d375910456d8192068cde5e63c3b60ded87862af50ea89c6b64224e8c105e00dd