nss: upgrade to release 3.47.1

Fixes CVE-2019-11745.

Remove nss.fix-freebl-add-lcc-support.patch.1, fixed upstream.

Reviewed-on: https://gerrit.libreoffice.org/83673
Tested-by: Jenkins
Reviewed-by: Michael Stahl <michael.stahl@cib.de>
(cherry picked from commit a6238c3fba80889f9090d997e2a4979b78b34ac7)

Change-Id: I72e35c90fabb0a83f547a787dbaee774e35f9c08
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/94379
Tested-by: Andras Timar <andras.timar@collabora.com>
Reviewed-by: Andras Timar <andras.timar@collabora.com>

8 files changed, 38 insertions, 30 deletions

diff --git a/download.lst b/download.lst
index 8b901874c5cf..5e0610acd713 100644
--- a/download.lst
+++ b/download.lst
@@ -203,8 +203,8 @@ export MYTHES_SHA256SUM := 1e81f395d8c851c3e4e75b568e20fa2fa549354e75ab397f9de4b
 export MYTHES_TARBALL := a8c2c5b8f09e7ede322d5c602ff6a4b6-mythes-1.2.4.tar.gz
 export NEON_SHA256SUM := db0bd8cdec329b48f53a6f00199c92d5ba40b0f015b153718d1b15d3d967fbca
 export NEON_TARBALL := neon-0.30.2.tar.gz
-export NSS_SHA256SUM := fae11751100510d26f16a245f0db9a5b3d638ab28ce0bccd50d4314f7e526ba1
-export NSS_TARBALL := nss-3.45-with-nspr-4.21.tar.gz
+export NSS_SHA256SUM := 07d4276168f59bb3038c7826dabb5fbfbab8336ddf65e4e6e43bce89ada78c64
+export NSS_TARBALL := nss-3.47.1-with-nspr-4.23.tar.gz
 export ODFGEN_SHA256SUM := 2c7b21892f84a4c67546f84611eccdad6259875c971e98ddb027da66ea0ac9c2
 export ODFGEN_VERSION_MICRO := 6
 export ODFGEN_TARBALL := libodfgen-0.1.$(ODFGEN_VERSION_MICRO).tar.bz2
diff --git a/external/nss/UnpackedTarball_nss.mk b/external/nss/UnpackedTarball_nss.mk
index 916fa0df171b..9783b1928097 100644
--- a/external/nss/UnpackedTarball_nss.mk
+++ b/external/nss/UnpackedTarball_nss.mk
@@ -22,7 +22,6 @@ $(eval $(call gb_UnpackedTarball_add_patches,nss,\
 		external/nss/nss.vs2015.patch) \
     external/nss/ubsan.patch.0 \
     external/nss/clang-cl.patch.0 \
-    external/nss/nss.fix-freebl-add-lcc-support.patch.1 \
     $(if $(filter iOS,$(OS)), \
         external/nss/nss-ios.patch) \
 	$(if $(filter MSC-INTEL,$(COM)-$(CPUNAME)), \
diff --git a/external/nss/clang-cl.patch.0 b/external/nss/clang-cl.patch.0
index 111ec934d147..1d615c2397d8 100644
--- a/external/nss/clang-cl.patch.0
+++ b/external/nss/clang-cl.patch.0
@@ -22,7 +22,7 @@
 +     defined(_M_ARM64)) && !defined __clang__
  # include <intrin.h>
  # pragma  intrinsic(_BitScanForward,_BitScanReverse)
-   __forceinline static int __prBitScanForward32(unsigned int val)
+ __forceinline static int __prBitScanForward32(unsigned int val)
 @@ -32,7 +32,7 @@
  # define pr_bitscan_ctz32(val)  __prBitScanForward32(val)
  # define pr_bitscan_clz32(val)  __prBitScanReverse32(val)
diff --git a/external/nss/nss-android.patch.1 b/external/nss/nss-android.patch.1
index 4c03dce226f0..4f10a009463c 100644
--- a/external/nss/nss-android.patch.1
+++ b/external/nss/nss-android.patch.1
@@ -4,7 +4,7 @@ diff -ur nss.org/nspr/build/autoconf/config.sub nss/nspr/build/autoconf/config.s
 @@ -111,6 +111,11 @@
      exit 1;;
  esac
- 
+
 +if test $1 = "arm-unknown-linux-androideabi"; then echo $1; exit; fi
 +if test $1 = "aarch64-unknown-linux-android"; then echo $1; exit; fi
 +if test $1 = "i686-pc-linux-android"; then echo $1; exit; fi
@@ -18,7 +18,7 @@ diff -ur nss.org/nspr/configure nss/nspr/configure
 +++ nss/nspr/configure	2017-09-07 15:31:47.604075663 +0200
 @@ -2737,18 +2739,15 @@
      esac
- 
+
          AS="$android_toolchain"/bin/"$android_tool_prefix"-as
 -    CC="$android_toolchain"/bin/"$android_tool_prefix"-gcc
 -    CXX="$android_toolchain"/bin/"$android_tool_prefix"-g++
@@ -30,14 +30,14 @@ diff -ur nss.org/nspr/configure nss/nspr/configure
      AR="$android_toolchain"/bin/"$android_tool_prefix"-ar
      RANLIB="$android_toolchain"/bin/"$android_tool_prefix"-ranlib
      STRIP="$android_toolchain"/bin/"$android_tool_prefix"-strip
- 
+
      CPPFLAGS="-I$android_platform/usr/include $CPPFLAGS"
 -    CFLAGS="-mandroid -I$android_platform/usr/include -fno-short-enums -fno-exceptions $CFLAGS"
 -    CXXFLAGS="-mandroid -I$android_platform/usr/include -fpic -fno-short-enums -fno-exceptions $CXXFLAGS"
 -    LDFLAGS="-mandroid -L$android_platform/usr/lib -Wl,-rpath-link=$android_platform/usr/lib --sysroot=$android_platform $LDFLAGS"
- 
+
      $as_echo "#define ANDROID 1" >>confdefs.h
- 
+
 diff -ur nss.org/nss/Makefile nss/nss/Makefile
 --- nss.org/nss/Makefile	2017-09-07 15:29:44.933245745 +0200
 +++ nss/nss/Makefile	2017-09-07 15:32:04.347181076 +0200
@@ -49,6 +49,14 @@ diff -ur nss.org/nss/Makefile nss/nss/Makefile
                         --with-android-version=$(OS_TARGET_RELEASE) \
                         --with-android-toolchain=$(ANDROID_TOOLCHAIN) \
                         --with-android-platform=$(ANDROID_SYSROOT)
+@@ -140,7 +140,6 @@
+
+ build_nspr: $(NSPR_CONFIG_STATUS)
+ 	$(MAKE) -C $(CORE_DEPTH)/../nspr/$(OBJDIR_NAME)
+-	$(MAKE) -C $(CORE_DEPTH)/../nspr/$(OBJDIR_NAME)/pr/tests
+
+ install_nspr: build_nspr
+ 	$(MAKE) -C $(CORE_DEPTH)/../nspr/$(OBJDIR_NAME) install
 diff -ur nss/nss/coreconf/arch.mk nss/nss/coreconf/arch.mk
 --- nss/nss/coreconf/arch.mk	2019-11-01 10:29:44.933245745 +0100
 +++ nss/nss/coreconf/arch.mk	2019-11-01 10:32:04.347181076 +0100
@@ -65,3 +73,14 @@ diff -ur nss/nss/coreconf/arch.mk nss/nss/coreconf/arch.mk
     OS_ARCH = Android
     ifndef OS_TARGET_RELEASE
  	OS_TARGET_RELEASE := 8
+--- nss-3.47.1/nss/lib/ckfw/builtins/manifest.mn	2019-11-19 20:55:30.000000000 +0100
++++ nss-3.45/nss/lib/ckfw/builtins/manifest.mn	2019-07-05 18:02:31.000000000 +0200
+@@ -5,8 +5,6 @@
+ 
+ CORE_DEPTH = ../../..
+ 
+-DIRS = testlib
+-
+ MODULE = nss
+ MAPFILE = $(OBJDIR)/nssckbi.def
+ 
diff --git a/external/nss/nss.aix.patch b/external/nss/nss.aix.patch
index da9aacb10e84..4b0c6bfb3261 100644
--- a/external/nss/nss.aix.patch
+++ b/external/nss/nss.aix.patch
@@ -38,7 +38,7 @@ diff -ru a/nspr/pr/src/Makefile.in b/nspr/pr/src/Makefile.in
 --- a/a/nspr/pr/src/Makefile.in	2014-09-29 16:46:35.281395079 +0100
 +++ b/b/nspr/pr/src/Makefile.in	2014-09-29 16:50:33.909375948 +0100
 @@ -74,7 +74,6 @@
- endif
+ endif	# SunOS
  
  ifeq ($(OS_ARCH),AIX)
 -DSO_LDOPTS	+= -binitfini::_PR_Fini
diff --git a/external/nss/nss.fix-freebl-add-lcc-support.patch.1 b/external/nss/nss.fix-freebl-add-lcc-support.patch.1
deleted file mode 100644
index 3e3c06327dde..000000000000
--- a/external/nss/nss.fix-freebl-add-lcc-support.patch.1
+++ /dev/null
@@ -1,11 +0,0 @@
---- b/nss/lib/freebl/Makefile
-+++ a/nss/lib/freebl/Makefile
-@@ -495,7 +495,7 @@
- ifdef USE_64
- # no __int128 at least up to lcc 1.23 (pretending to be gcc5)
- # NB: CC_NAME is not defined here
--ifneq ($(shell $(CC) -? 2>&1 >/dev/null | sed -e 's/:.*//;1q'),lcc)
-+ifneq ($(shell $(CC) -? 2>&1 >/dev/null </dev/null | sed -e 's/:.*//;1q'),lcc)
-     ifdef CC_IS_CLANG
-             HAVE_INT128_SUPPORT = 1
-             DEFINES += -DHAVE_INT128_SUPPORT
diff --git a/external/nss/nss.patch b/external/nss/nss.patch
index c367bce9097b..90df93b5e232 100644
--- a/external/nss/nss.patch
+++ b/external/nss/nss.patch
@@ -12,14 +12,14 @@
 --- a/nss.orig/nspr/pr/src/misc/prnetdb.c	2017-08-29 23:44:13.690045031 +0530
 +++ b/nss/nspr/pr/src/misc/prnetdb.c	2017-08-29 23:47:03.810814019 +0530
 @@ -438,7 +438,7 @@
- 	char *buf = *bufp;
- 	PRIntn buflen = *buflenp;
+     char *buf = *bufp;
+     PRIntn buflen = *buflenp;
  
--	if (align && ((long)buf & (align - 1))) {
-+	if (align && ((ptrdiff_t)buf & (align - 1))) {
- 		PRIntn skip = align - ((ptrdiff_t)buf & (align - 1));
- 		if (buflen < skip) {
- 			return 0;
+-    if (align && ((long)buf & (align - 1))) {
++    if (align && ((ptrdiff_t)buf & (align - 1))) {
+         PRIntn skip = align - ((ptrdiff_t)buf & (align - 1));
+         if (buflen < skip) {
+             return 0;
 --- a/a/nss/cmd/platlibs.mk	2017-08-29 23:44:13.554044416 +0530
 +++ b/b/nss/cmd/platlibs.mk	2017-08-29 23:46:09.638569150 +0530
 @@ -10,17 +10,22 @@
@@ -153,3 +153,4 @@
  #! gmake
  #
  # This Source Code Form is subject to the terms of the Mozilla Public
+
diff --git a/external/nss/nss.vs2015.pdb.patch b/external/nss/nss.vs2015.pdb.patch
index dc4f4638b476..c66940132cdd 100644
--- a/external/nss/nss.vs2015.pdb.patch
+++ b/external/nss/nss.vs2015.pdb.patch
@@ -18,5 +18,5 @@ diff -ru nss.orig/nss/coreconf/WIN32.mk nss/nss/coreconf/WIN32.mk
 -	OPTIMIZER += -Zi -Fd$(OBJDIR)/ -Od
 +	OPTIMIZER += -Zi -Fd./ -Od
  	NULLSTRING :=
- 	SPACE      := $(NULLSTRING) # end of the line
- 	USERNAME   := $(subst $(SPACE),_,$(USERNAME))
+ 	DEFINES    += -DDEBUG -UNDEBUG
+ 	DLLFLAGS   += -DEBUG -OUT:$@