[MIR] liboauth

Looks good to me. Has a test suite, symbols file, compiles clean, well maintained. But passing to security team for a sign-off there too.

In case it has any impact, there's currently a patch for xmalloc in the package, but I've spoken to Bilal already about it, the patch can be dropped and the package builds (it was meant to fix test failures) -- Bilal mentioned uploading a new revision without the patch shortly.

I'll get the patch removed, when I get my laptop back after repairs. I'm currently on mobile, sorry for that. anyway the issue is too minor, and won't be a problem in 99% of cases.

Could somebody from the security team does that review?

- should be made multiarch-aware for packaging

- what is NSS_NoDB_Init(".") ? Is this a current-directory problem?

- xmalloc seems weird...
    - exit in shlib?
    - does not return NULL
    - potential bypass xmalloc checks via nmemb*size == 0 failure

- potential allocation and copy miscalcuations (nmemb*size) can overflow
    WriteMemoryCallback
    ReadMemoryCallback
  but probably okay, in interface to curl... needs further investigation

- good: misspelling ABI compatibility! :)
- good: time indep compare
- good: clears some private key memory

Thanks for the review, Kees, I'm working on all of the above points. I'll soon upload a new version to Debian, and I'll merge Mathieu's recent Ubuntu upload as well.

Bilal, is there any news on that work? The Oneiric feature freeze is tomorrow

Kees,

The NSS_NoDB_Init function initializes an NSS instance without a DB. The recommended way of calling the function, according to Mozilla's docs, is NSS_NoDB_Init(".") , while there's no difference if the function was called like NSS_NoDB_Init(NULL);

In the new upload which will hit the archive today, xmalloc_fatal will return NULL, as expected. I had already removed the exit function in patch 02_xmalloc_dont_exit.patch, but it seems like you didn't run quilt push -a before reviewing the package, and hence didn't get the change.

The new upload will also enable multiarch support.

As for the nmemb*size == 0 check, I don't think it really is an issue. I can't think of any scenario which might cause an overflow.

Uploaded liboauth 0.9.4-1ubuntu2 with the fixes. Could someone from the security team review again?

Also, the -1ubuntu2 upload is just a temporary place-holder while the same upload gets sponsored into Debian with a version number -2

This looks good, thanks. +1

2011-08-11 16:59:13 INFO Override Component to: 'main'
2011-08-11 16:59:13 INFO 'liboauth - 0.9.4-2/universe/libs' source overridden
2011-08-11 16:59:13 INFO 'liboauth-dev-0.9.4-2/universe/libdevel/OPTIONAL' binary overridden in oneiric/amd64
2011-08-11 16:59:13 INFO 'liboauth-dev-0.9.4-2/universe/libdevel/OPTIONAL' binary overridden in oneiric/armel
2011-08-11 16:59:13 INFO 'liboauth-dev-0.9.4-2/universe/libdevel/OPTIONAL' binary overridden in oneiric/i386
2011-08-11 16:59:13 INFO 'liboauth-dev-0.9.4-1ubuntu2/universe/libdevel/OPTIONAL' binary overridden in oneiric/powerpc
2011-08-11 16:59:13 INFO 'liboauth0-0.9.4-2/universe/libs/OPTIONAL' binary overridden in oneiric/amd64
2011-08-11 16:59:13 INFO 'liboauth0-0.9.4-2/universe/libs/OPTIONAL' binary overridden in oneiric/armel
2011-08-11 16:59:13 INFO 'liboauth0-0.9.4-2/universe/libs/OPTIONAL' binary overridden in oneiric/i386
2011-08-11 16:59:13 INFO 'liboauth0-0.9.4-1ubuntu2/universe/libs/OPTIONAL' binary overridden in oneiric/powerpc