Cause: Some packages call nss without initializing as mandated by the API and nss did not protect itself against such improper usage.
Consequence: This caused crashes on shutdown as some variables haven't been properly initialized. Such crashes were reported in the messaging daemon (qpidd) included in Red Hat Enterprise MRG after a recent update to nss. This occurred as qpidd made nss calls before initializing nss.
Fix: Wit this fix nss now protects itself against potential improper use by client code.
Result: With this update nss prevents qpidd, and other affected processes that may call nss without initializing as mandated by the API, from crashing
The problem seems to be fixed. Tested on RHEL5.7 and RHEL5.8 (i386 and x86_64).
Packages used for testing:
python-qpid-0.10-1.el5
python-qpid-qmf-0.10-11.el5
qpid-cpp-client-0.10-10.el5
qpid-cpp-client-devel-0.10-10.el5
qpid-cpp-client-devel-docs-0.10-10.el5
qpid-cpp-client-rdma-0.10-10.el5
qpid-cpp-client-ssl-0.10-10.el5
qpid-cpp-mrg-debuginfo-0.10-10.el5
qpid-cpp-server-0.10-10.el5
qpid-cpp-server-cluster-0.10-10.el5
qpid-cpp-server-devel-0.10-10.el5
qpid-cpp-server-rdma-0.10-10.el5
qpid-cpp-server-ssl-0.10-10.el5
qpid-cpp-server-store-0.10-10.el5
qpid-cpp-server-xml-0.10-10.el5
qpid-qmf-0.10-11.el5
qpid-tools-0.10-6.el5
rh-qpid-cpp-tests-0.10-10.el5
-> VERIFIED
Comment #2 was related to a build of qpid-cpp that had a fix. We have since deferred that fix and will instead wait for an updated nss.
Comment 5Elio Maldonado Batiz
2012-02-28 19:02:39 UTC
Created attachment 566380[details]
Protect NSS_Shutdown against clients that don't initialize nss
This patch is identical to the one approved for Bug 797426.
Comment 6Kai Engert (:kaie) (inactive account)
2012-02-28 19:54:31 UTC
Comment on attachment 566380[details]
Protect NSS_Shutdown against clients that don't initialize nss
yes, this patch is the same patch as in the other bug.
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
http://rhn.redhat.com/errata/RHBA-2013-0081.html