widespread changes to reduce compiler warnings. liberal application of const.

12 files changed, 82 insertions, 79 deletions

diff --git a/security/nss/lib/freebl/alg2268.c b/security/nss/lib/freebl/alg2268.c
index c053bce08..86e110871 100644
--- a/security/nss/lib/freebl/alg2268.c
+++ b/security/nss/lib/freebl/alg2268.c
@@ -47,7 +47,7 @@
 */
 
 typedef SECStatus (rc2Func)(RC2Context *cx, unsigned char *output,
-		           unsigned char *input, unsigned int inputLen);
+		           const unsigned char *input, unsigned int inputLen);
 
 /* forward declarations */
 static rc2Func rc2_EncryptECB;
@@ -348,7 +348,7 @@ rc2_Decrypt1Block(RC2Context *cx, RC2Block *output, RC2Block *input)
 
 static SECStatus
 rc2_EncryptECB(RC2Context *cx, unsigned char *output,
-	       unsigned char *input, unsigned int inputLen)
+	       const unsigned char *input, unsigned int inputLen)
 {
     RC2Block  iBlock;
 
@@ -365,7 +365,7 @@ rc2_EncryptECB(RC2Context *cx, unsigned char *output,
 
 static SECStatus
 rc2_DecryptECB(RC2Context *cx, unsigned char *output,
-	       unsigned char *input, unsigned int inputLen)
+	       const unsigned char *input, unsigned int inputLen)
 {
     RC2Block  iBlock;
 
@@ -382,7 +382,7 @@ rc2_DecryptECB(RC2Context *cx, unsigned char *output,
 
 static SECStatus
 rc2_EncryptCBC(RC2Context *cx, unsigned char *output,
-	       unsigned char *input, unsigned int inputLen)
+	       const unsigned char *input, unsigned int inputLen)
 {
     RC2Block  iBlock;
 
@@ -403,7 +403,7 @@ rc2_EncryptCBC(RC2Context *cx, unsigned char *output,
 
 static SECStatus
 rc2_DecryptCBC(RC2Context *cx, unsigned char *output,
-	       unsigned char *input, unsigned int inputLen)
+	       const unsigned char *input, unsigned int inputLen)
 {
     RC2Block  iBlock;
     RC2Block  oBlock;
@@ -436,7 +436,7 @@ rc2_DecryptCBC(RC2Context *cx, unsigned char *output,
 */
 SECStatus RC2_Encrypt(RC2Context *cx, unsigned char *output,
 		      unsigned int *outputLen, unsigned int maxOutputLen,
-		      unsigned char *input, unsigned int inputLen)
+		      const unsigned char *input, unsigned int inputLen)
 {
     SECStatus rv = SECSuccess;
     if (inputLen) {
@@ -469,7 +469,7 @@ SECStatus RC2_Encrypt(RC2Context *cx, unsigned char *output,
 */
 SECStatus RC2_Decrypt(RC2Context *cx, unsigned char *output,
 		      unsigned int *outputLen, unsigned int maxOutputLen,
-		      unsigned char *input, unsigned int inputLen)
+		      const unsigned char *input, unsigned int inputLen)
 {
     SECStatus rv = SECSuccess;
     if (inputLen) {
diff --git a/security/nss/lib/freebl/arcfive.c b/security/nss/lib/freebl/arcfive.c
index b36a76d2d..2ee3f5447 100644
--- a/security/nss/lib/freebl/arcfive.c
+++ b/security/nss/lib/freebl/arcfive.c
@@ -86,7 +86,7 @@ RC5_DestroyContext(RC5Context *cx, PRBool freeit)
 SECStatus 
 RC5_Encrypt(RC5Context *cx, unsigned char *output, unsigned int *outputLen, 
 	    unsigned int maxOutputLen, 
-	    unsigned char *input, unsigned int inputLen)
+	    const unsigned char *input, unsigned int inputLen)
 {
     PORT_SetError(PR_NOT_IMPLEMENTED_ERROR);
     return SECFailure;
@@ -106,7 +106,7 @@ RC5_Encrypt(RC5Context *cx, unsigned char *output, unsigned int *outputLen,
 SECStatus 
 RC5_Decrypt(RC5Context *cx, unsigned char *output, unsigned int *outputLen, 
 	    unsigned int maxOutputLen,
-            unsigned char *input, unsigned int inputLen)
+            const unsigned char *input, unsigned int inputLen)
 {
     PORT_SetError(PR_NOT_IMPLEMENTED_ERROR);
     return SECFailure;
diff --git a/security/nss/lib/freebl/arcfour.c b/security/nss/lib/freebl/arcfour.c
index ea80c2776..bb7bd8f90 100644
--- a/security/nss/lib/freebl/arcfour.c
+++ b/security/nss/lib/freebl/arcfour.c
@@ -197,7 +197,7 @@ rc4_no_opt(RC4Context *cx, unsigned char *output,
 	Stype tmpSi, tmpSj;
 	register PRUint8 tmpi = cx->i;
 	register PRUint8 tmpj = cx->j;
-	int index;
+	unsigned int index;
 	PORT_Assert(maxOutputLen >= inputLen);
 	if (maxOutputLen < inputLen) {
 		PORT_SetError(SEC_ERROR_INVALID_ARGS);
@@ -350,7 +350,7 @@ rc4_wordconv(RC4Context *cx, unsigned char *output,
 	register PRUint8 tmpj = cx->j;
 	unsigned int byteCount;
 	unsigned int bufShift, invBufShift;
-	int i;
+	unsigned int i;
 
 	PORT_Assert(maxOutputLen >= inputLen);
 	if (maxOutputLen < inputLen) {
diff --git a/security/nss/lib/freebl/blapi.h b/security/nss/lib/freebl/blapi.h
index 4e613772d..2bd4c3274 100644
--- a/security/nss/lib/freebl/blapi.h
+++ b/security/nss/lib/freebl/blapi.h
@@ -67,7 +67,7 @@ extern RSAPrivateKey *RSA_NewKey(int         keySizeInBits,
 */
 extern SECStatus RSA_PublicKeyOp(RSAPublicKey *   key,
 				 unsigned char *  output,
-				 unsigned char *  input);
+				 const unsigned char *  input);
 
 /*
 ** Perform a raw private-key operation 
@@ -75,7 +75,7 @@ extern SECStatus RSA_PublicKeyOp(RSAPublicKey *   key,
 */
 extern SECStatus RSA_PrivateKeyOp(RSAPrivateKey *  key,
 				  unsigned char *  output,
-				  unsigned char *  input);
+				  const unsigned char *  input);
 
 
 
@@ -89,7 +89,7 @@ extern SECStatus RSA_PrivateKeyOp(RSAPrivateKey *  key,
 **	"params" is a pointer to the PQG parameters for the domain
 **	Uses a random seed.
 */
-extern SECStatus DSA_NewKey(PQGParams *           params, 
+extern SECStatus DSA_NewKey(const PQGParams *     params, 
 		            DSAPrivateKey **      privKey);
 
 /* signature is caller-supplied buffer of at least 20 bytes.
@@ -100,25 +100,26 @@ extern SECStatus DSA_NewKey(PQGParams *           params,
 */
 extern SECStatus DSA_SignDigest(DSAPrivateKey *   key,
 				SECItem *         signature,
-				SECItem *         digest);
+				const SECItem *   digest);
 
 /* signature is caller-supplied buffer of at least 20 bytes.
 ** On input,  signature->len == size of buffer to hold signature.
 **            digest->len    == size of digest.
 */
 extern SECStatus DSA_VerifyDigest(DSAPublicKey *  key,
-				  SECItem *       signature,
-				  SECItem *       digest);
+				  const SECItem * signature,
+				  const SECItem * digest);
 
 /* For FIPS compliance testing. Seed must be exactly 20 bytes long */
-extern SECStatus DSA_NewKeyFromSeed(PQGParams *params, unsigned char * seed,
+extern SECStatus DSA_NewKeyFromSeed(const PQGParams *params, 
+                                    const unsigned char * seed,
                                     DSAPrivateKey **privKey);
 
 /* For FIPS compliance testing. Seed must be exactly 20 bytes. */
 extern SECStatus DSA_SignDigestWithSeed(DSAPrivateKey * key,
-				        SECItem *       signature,
-				        SECItem *       digest,
-				        unsigned char * seed);
+                                        SECItem *       signature,
+                                        const SECItem * digest,
+                                        const unsigned char * seed);
 
 /******************************************************
 ** Diffie Helman key exchange algorithm 
@@ -262,7 +263,7 @@ extern void RC2_DestroyContext(RC2Context *cx, PRBool freeit);
 */
 extern SECStatus RC2_Encrypt(RC2Context *cx, unsigned char *output,
 			    unsigned int *outputLen, unsigned int maxOutputLen,
-			    unsigned char *input, unsigned int inputLen);
+			    const unsigned char *input, unsigned int inputLen);
 
 /*
 ** Perform RC2 decryption.
@@ -277,7 +278,7 @@ extern SECStatus RC2_Encrypt(RC2Context *cx, unsigned char *output,
 */
 extern SECStatus RC2_Decrypt(RC2Context *cx, unsigned char *output,
 			    unsigned int *outputLen, unsigned int maxOutputLen,
-			    unsigned char *input, unsigned int inputLen);
+			    const unsigned char *input, unsigned int inputLen);
 
 /******************************************/
 /*
@@ -317,7 +318,7 @@ extern void RC5_DestroyContext(RC5Context *cx, PRBool freeit);
 */
 extern SECStatus RC5_Encrypt(RC5Context *cx, unsigned char *output,
                             unsigned int *outputLen, unsigned int maxOutputLen,
-                            unsigned char *input, unsigned int inputLen);
+                            const unsigned char *input, unsigned int inputLen);
 
 /*
 ** Perform RC5 decryption.
@@ -333,7 +334,7 @@ extern SECStatus RC5_Encrypt(RC5Context *cx, unsigned char *output,
 
 extern SECStatus RC5_Decrypt(RC5Context *cx, unsigned char *output,
                             unsigned int *outputLen, unsigned int maxOutputLen,
-                            unsigned char *input, unsigned int inputLen);
+                            const unsigned char *input, unsigned int inputLen);
 
 
 
@@ -379,7 +380,7 @@ extern void DES_DestroyContext(DESContext *cx, PRBool freeit);
 */
 extern SECStatus DES_Encrypt(DESContext *cx, unsigned char *output,
 			    unsigned int *outputLen, unsigned int maxOutputLen,
-			    unsigned char *input, unsigned int inputLen);
+			    const unsigned char *input, unsigned int inputLen);
 
 /*
 ** Perform DES decryption.
@@ -396,7 +397,7 @@ extern SECStatus DES_Encrypt(DESContext *cx, unsigned char *output,
 */
 extern SECStatus DES_Decrypt(DESContext *cx, unsigned char *output,
 			    unsigned int *outputLen, unsigned int maxOutputLen,
-			    unsigned char *input, unsigned int inputLen);
+			    const unsigned char *input, unsigned int inputLen);
 
 /******************************************/
 /*
@@ -436,7 +437,7 @@ AES_DestroyContext(AESContext *cx, PRBool freeit);
 extern SECStatus 
 AES_Encrypt(AESContext *cx, unsigned char *output,
             unsigned int *outputLen, unsigned int maxOutputLen,
-            unsigned char *input, unsigned int inputLen);
+            const unsigned char *input, unsigned int inputLen);
 
 /*
 ** Perform AES decryption.
@@ -452,7 +453,7 @@ AES_Encrypt(AESContext *cx, unsigned char *output,
 extern SECStatus 
 AES_Decrypt(AESContext *cx, unsigned char *output,
             unsigned int *outputLen, unsigned int maxOutputLen,
-            unsigned char *input, unsigned int inputLen);
+            const unsigned char *input, unsigned int inputLen);
 
 
 /******************************************/
diff --git a/security/nss/lib/freebl/des.c b/security/nss/lib/freebl/des.c
index e5cd8dd0f..9b44f8c35 100644
--- a/security/nss/lib/freebl/des.c
+++ b/security/nss/lib/freebl/des.c
@@ -570,7 +570,7 @@ DES_MakeSchedule( HALF * ks, BYTE * key,   DESDirection direction)
     left  ^= temp << 4; 
 
 void 
-DES_Do1Block(HALF * ks, BYTE * inbuf, BYTE * outbuf)
+DES_Do1Block(HALF * ks, const BYTE * inbuf, BYTE * outbuf)
 {
     register HALF left, right;
     register HALF temp;
diff --git a/security/nss/lib/freebl/des.h b/security/nss/lib/freebl/des.h
index 0e711c4d5..472896ef1 100644
--- a/security/nss/lib/freebl/des.h
+++ b/security/nss/lib/freebl/des.h
@@ -50,7 +50,7 @@ typedef enum {
     DES_DECRYPT = 0xAAAA
 } DESDirection;
 
-typedef void DESFunc(struct DESContextStr *cx, BYTE *out, BYTE *in, 
+typedef void DESFunc(struct DESContextStr *cx, BYTE *out, const BYTE *in, 
                      unsigned int len);
 
 struct DESContextStr {
@@ -64,6 +64,6 @@ struct DESContextStr {
 };
 
 void DES_MakeSchedule( HALF * ks, BYTE * key,   DESDirection direction);
-void DES_Do1Block(     HALF * ks, BYTE * inbuf, BYTE * outbuf);
+void DES_Do1Block(     HALF * ks, const BYTE * inbuf, BYTE * outbuf);
 
 #endif
diff --git a/security/nss/lib/freebl/desblapi.c b/security/nss/lib/freebl/desblapi.c
index 9b7f29f61..9d1097bd6 100644
--- a/security/nss/lib/freebl/desblapi.c
+++ b/security/nss/lib/freebl/desblapi.c
@@ -71,7 +71,7 @@
 #define COPY8BFROMHALF(to, from) COPY8B(to, from, to)
 
 static void 
-DES_ECB(DESContext *cx, BYTE *out, BYTE *in, unsigned int len)
+DES_ECB(DESContext *cx, BYTE *out, const BYTE *in, unsigned int len)
 {
     while (len) {
 	DES_Do1Block(cx->ks0, in, out);
@@ -82,7 +82,7 @@ DES_ECB(DESContext *cx, BYTE *out, BYTE *in, unsigned int len)
 }
 
 static void 
-DES_EDE3_ECB(DESContext *cx, BYTE *out, BYTE *in, unsigned int len)
+DES_EDE3_ECB(DESContext *cx, BYTE *out, const BYTE *in, unsigned int len)
 {
     while (len) {
 	DES_Do1Block(cx->ks0,  in, out);
@@ -95,7 +95,7 @@ DES_EDE3_ECB(DESContext *cx, BYTE *out, BYTE *in, unsigned int len)
 }
 
 static void 
-DES_CBCEn(DESContext *cx, BYTE *out, BYTE *in, unsigned int len)
+DES_CBCEn(DESContext *cx, BYTE *out, const BYTE *in, unsigned int len)
 {
     BYTE * bufend = in + len;
     HALF  vec[2];
@@ -112,7 +112,7 @@ DES_CBCEn(DESContext *cx, BYTE *out, BYTE *in, unsigned int len)
 }
 
 static void 
-DES_CBCDe(DESContext *cx, BYTE *out, BYTE *in, unsigned int len)
+DES_CBCDe(DESContext *cx, BYTE *out, const BYTE *in, unsigned int len)
 {
     BYTE * bufend;
     HALF oldciphertext[2];
@@ -132,7 +132,7 @@ DES_CBCDe(DESContext *cx, BYTE *out, BYTE *in, unsigned int len)
 }
 
 static void 
-DES_EDE3CBCEn(DESContext *cx, BYTE *out, BYTE *in, unsigned int len)
+DES_EDE3CBCEn(DESContext *cx, BYTE *out, const BYTE *in, unsigned int len)
 {
     BYTE * bufend = in + len;
     HALF  vec[2];
@@ -151,7 +151,7 @@ DES_EDE3CBCEn(DESContext *cx, BYTE *out, BYTE *in, unsigned int len)
 }
 
 static void 
-DES_EDE3CBCDe(DESContext *cx, BYTE *out, BYTE *in, unsigned int len)
+DES_EDE3CBCDe(DESContext *cx, BYTE *out, const BYTE *in, unsigned int len)
 {
     BYTE * bufend;
     HALF oldciphertext[2];
@@ -242,7 +242,7 @@ DES_DestroyContext(DESContext *cx, PRBool freeit)
 
 SECStatus
 DES_Encrypt(DESContext *cx, BYTE *out, unsigned int *outLen,
-            unsigned int maxOutLen, BYTE *in, unsigned int inLen)
+            unsigned int maxOutLen, const BYTE *in, unsigned int inLen)
 {
 
     if (inLen < 0 || (inLen % 8) != 0 || maxOutLen < inLen || !cx || 
@@ -259,7 +259,7 @@ DES_Encrypt(DESContext *cx, BYTE *out, unsigned int *outLen,
 
 SECStatus
 DES_Decrypt(DESContext *cx, BYTE *out, unsigned int *outLen,
-            unsigned int maxOutLen, BYTE *in, unsigned int inLen)
+            unsigned int maxOutLen, const BYTE *in, unsigned int inLen)
 {
 
     if (inLen < 0 || (inLen % 8) != 0 || maxOutLen < inLen || !cx || 
diff --git a/security/nss/lib/freebl/dsa.c b/security/nss/lib/freebl/dsa.c
index 60003cbb9..48af34cbd 100644
--- a/security/nss/lib/freebl/dsa.c
+++ b/security/nss/lib/freebl/dsa.c
@@ -70,7 +70,8 @@ static void translate_mpi_error(mp_err err)
 }
 
 SECStatus 
-dsa_NewKey(PQGParams *params, DSAPrivateKey **privKey, unsigned char *xb)
+dsa_NewKey(const PQGParams *params, DSAPrivateKey **privKey, 
+           const unsigned char *xb)
 {
     unsigned int y_len;
     mp_int p, g;
@@ -147,7 +148,7 @@ cleanup:
 **	Uses a random seed.
 */
 SECStatus 
-DSA_NewKey(PQGParams *params, DSAPrivateKey **privKey)
+DSA_NewKey(const PQGParams *params, DSAPrivateKey **privKey)
 {
     SECStatus rv;
     unsigned char seed[DSA_SUBPRIME_LEN];
@@ -157,25 +158,23 @@ DSA_NewKey(PQGParams *params, DSAPrivateKey **privKey)
 	return SECFailure;
     /* Generate a new DSA key using random seed. */
     rv = dsa_NewKey(params, privKey, seed);
-    /* memset(seed, 0, DSA_SUBPRIME_LEN); */
     return rv;
 }
 
 /* For FIPS compliance testing. Seed must be exactly 20 bytes long */
 SECStatus 
-DSA_NewKeyFromSeed(PQGParams *params, 
-                   unsigned char *seed,
+DSA_NewKeyFromSeed(const PQGParams *params, 
+                   const unsigned char *seed,
                    DSAPrivateKey **privKey)
 {
     SECStatus rv;
     rv = dsa_NewKey(params, privKey, seed);
-    /* memset(seed, 0, DSA_SUBPRIME_LEN); */
     return rv;
 }
 
 SECStatus 
-dsa_SignDigest(DSAPrivateKey *key, SECItem *signature, SECItem *digest,
-               unsigned char *kb)
+dsa_SignDigest(DSAPrivateKey *key, SECItem *signature, const SECItem *digest,
+               const unsigned char *kb)
 {
     mp_int p, q, g;  /* PQG parameters */
     mp_int x, k;     /* private key & pseudo-random integer */
@@ -271,7 +270,7 @@ cleanup:
 ** Uses a random seed.
 */
 SECStatus 
-DSA_SignDigest(DSAPrivateKey *key, SECItem *signature, SECItem *digest)
+DSA_SignDigest(DSAPrivateKey *key, SECItem *signature, const SECItem *digest)
 {
     SECStatus rv;
     int prerr = 0;
@@ -283,7 +282,6 @@ DSA_SignDigest(DSAPrivateKey *key, SECItem *signature, SECItem *digest)
 	rv = dsa_SignDigest(key, signature, digest, KSEED);
 	if (rv) prerr = PORT_GetError();
     } while (prerr == SEC_ERROR_NEED_RANDOM);
-    /*memset(KSEED, 0, DSA_SUBPRIME_LEN);*/
     return rv;
 }
 
@@ -291,12 +289,11 @@ DSA_SignDigest(DSAPrivateKey *key, SECItem *signature, SECItem *digest)
 SECStatus 
 DSA_SignDigestWithSeed(DSAPrivateKey * key,
                        SECItem *       signature,
-                       SECItem *       digest,
-                       unsigned char * seed)
+                       const SECItem * digest,
+                       const unsigned char * seed)
 {
     SECStatus rv;
     rv = dsa_SignDigest(key, signature, digest, seed);
-    /*memset(seed, 0, DSA_SUBPRIME_LEN);*/
     return rv;
 }
 
@@ -305,7 +302,8 @@ DSA_SignDigestWithSeed(DSAPrivateKey * key,
 **            digest->len    == size of digest.
 */
 SECStatus 
-DSA_VerifyDigest(DSAPublicKey *key, SECItem *signature, SECItem *digest)
+DSA_VerifyDigest(DSAPublicKey *key, const SECItem *signature, 
+                 const SECItem *digest)
 {
     /* FIPS-compliance dictates that digest is a SHA1 hash. */
     mp_int p, q, g;      /* PQG parameters */
diff --git a/security/nss/lib/freebl/md5.c b/security/nss/lib/freebl/md5.c
index b0c0ed6a0..c992cc4f1 100644
--- a/security/nss/lib/freebl/md5.c
+++ b/security/nss/lib/freebl/md5.c
@@ -461,7 +461,6 @@ void
 MD5_End(MD5Context *cx, unsigned char *digest,
         unsigned int *digestLen, unsigned int maxDigestLen)
 {
-	PRUint32 tmp;
 	PRUint32 lowInput, highInput;
 	PRUint32 inBufIndex = cx->lsbInput & 63;
 
diff --git a/security/nss/lib/freebl/rijndael.c b/security/nss/lib/freebl/rijndael.c
index b301f3222..ffdd2be3b 100644
--- a/security/nss/lib/freebl/rijndael.c
+++ b/security/nss/lib/freebl/rijndael.c
@@ -125,7 +125,7 @@
 static SECStatus
 rijndael_key_expansion7(AESContext *cx, unsigned char *key, unsigned int Nk)
 {
-    int i;
+    unsigned int i;
     PRUint32 *W;
     PRUint32 *pW;
     PRUint32 tmp;
@@ -153,11 +153,11 @@ rijndael_key_expansion7(AESContext *cx, unsigned char *key, unsigned int Nk)
 static SECStatus
 rijndael_key_expansion(AESContext *cx, unsigned char *key, unsigned int Nk)
 {
-    int i;
+    unsigned int i;
     PRUint32 *W;
     PRUint32 *pW;
     PRUint32 tmp;
-    int round_key_words = cx->Nb * (cx->Nr + 1);
+    unsigned int round_key_words = cx->Nb * (cx->Nr + 1);
     if (Nk == 7)
 	return rijndael_key_expansion7(cx, key, Nk);
     W = cx->expandedKey;
@@ -217,7 +217,7 @@ rijndael_key_expansion(AESContext *cx, unsigned char *key, unsigned int Nk)
 static SECStatus
 rijndael_invkey_expansion(AESContext *cx, unsigned char *key, unsigned int Nk)
 {
-    int r;
+    unsigned int r;
     PRUint32 *roundkeyw;
     PRUint8 *b;
     int Nb = cx->Nb;
@@ -296,9 +296,9 @@ rijndael_invkey_expansion(AESContext *cx, unsigned char *key, unsigned int Nk)
 static SECStatus 
 rijndael_encryptBlock128(AESContext *cx, 
                          unsigned char *output,
-                         unsigned char *input)
+                         const unsigned char *input)
 {
-    int r, extra_cols;
+    unsigned int r, extra_cols;
     PRUint32 *roundkeyw;
     PRUint8 clone[RIJNDAEL_MAX_STATE_SIZE];
     extra_cols = cx->Nb;
@@ -361,7 +361,7 @@ rijndael_encryptBlock128(AESContext *cx,
 static SECStatus 
 rijndael_decryptBlock128(AESContext *cx, 
                          unsigned char *output,
-                         unsigned char *input)
+                         const unsigned char *input)
 {
     int r, extra_cols;
     PRUint32 *roundkeyw;
@@ -439,10 +439,10 @@ rijndael_decryptBlock128(AESContext *cx,
 SECStatus 
 rijndael_encryptBlock(AESContext *cx, 
                       unsigned char *output,
-                      unsigned char *input)
+                      const unsigned char *input)
 {
-    int j, r, Nb;
-    int c2, c3;
+    unsigned int j, r, Nb;
+    unsigned int c2, c3;
     PRUint32 *roundkeyw;
     PRUint8 clone[RIJNDAEL_MAX_STATE_SIZE];
     Nb = cx->Nb;
@@ -478,7 +478,7 @@ rijndael_encryptBlock(AESContext *cx,
 SECStatus 
 rijndael_decryptBlock(AESContext *cx, 
                       unsigned char *output,
-                      unsigned char *input)
+                      const unsigned char *input)
 {
     int j, r, Nb;
     int c2, c3;
@@ -524,7 +524,8 @@ rijndael_decryptBlock(AESContext *cx,
 static SECStatus 
 rijndael_encryptECB(AESContext *cx, unsigned char *output,
                     unsigned int *outputLen, unsigned int maxOutputLen,
-                    unsigned char *input, unsigned int inputLen, int blocksize)
+                    const unsigned char *input, unsigned int inputLen, 
+                    int blocksize)
 {
     SECStatus rv;
     AESBlockFunc *encryptor;
@@ -544,21 +545,23 @@ rijndael_encryptECB(AESContext *cx, unsigned char *output,
 static SECStatus 
 rijndael_encryptCBC(AESContext *cx, unsigned char *output,
                     unsigned int *outputLen, unsigned int maxOutputLen,
-                    unsigned char *input, unsigned int inputLen, int blocksize)
+                    const unsigned char *input, unsigned int inputLen, 
+                    int blocksize)
 {
     int j;
     SECStatus rv;
     AESBlockFunc *encryptor;
     unsigned char *lastblock;
+    unsigned char inblock[RIJNDAEL_MAX_STATE_SIZE * 8];
     lastblock = cx->iv;
     encryptor = (blocksize == 16) ? &rijndael_encryptBlock128 : 
                                     &rijndael_encryptBlock;
     while (inputLen > 0) {
 	/* XOR with the last block (IV if first block) */
 	for (j=0; j<blocksize; ++j)
-	    input[j] ^= lastblock[j];
+	    inblock[j] = input[j] ^ lastblock[j];
 	/* encrypt */
-        rv = (*encryptor)(cx, output, input);
+        rv = (*encryptor)(cx, output, inblock);
 	if (rv != SECSuccess)
 	    return rv;
 	/* move to the next block */
@@ -573,7 +576,8 @@ rijndael_encryptCBC(AESContext *cx, unsigned char *output,
 static SECStatus 
 rijndael_decryptECB(AESContext *cx, unsigned char *output,
                     unsigned int *outputLen, unsigned int maxOutputLen,
-                    unsigned char *input, unsigned int inputLen, int blocksize)
+                    const unsigned char *input, unsigned int inputLen, 
+                    int blocksize)
 {
     SECStatus rv;
     AESBlockFunc *decryptor;
@@ -594,7 +598,8 @@ rijndael_decryptECB(AESContext *cx, unsigned char *output,
 static SECStatus 
 rijndael_decryptCBC(AESContext *cx, unsigned char *output,
                     unsigned int *outputLen, unsigned int maxOutputLen,
-                    unsigned char *input, unsigned int inputLen, int blocksize)
+                    const unsigned char *input, unsigned int inputLen, 
+                    int blocksize)
 {
     SECStatus rv;
     AESBlockFunc *decryptor;
@@ -728,7 +733,7 @@ AES_DestroyContext(AESContext *cx, PRBool freeit)
 SECStatus 
 AES_Encrypt(AESContext *cx, unsigned char *output,
             unsigned int *outputLen, unsigned int maxOutputLen,
-            unsigned char *input, unsigned int inputLen)
+            const unsigned char *input, unsigned int inputLen)
 {
     int blocksize;
     /* Check args */
@@ -759,7 +764,7 @@ AES_Encrypt(AESContext *cx, unsigned char *output,
 SECStatus 
 AES_Decrypt(AESContext *cx, unsigned char *output,
             unsigned int *outputLen, unsigned int maxOutputLen,
-            unsigned char *input, unsigned int inputLen)
+            const unsigned char *input, unsigned int inputLen)
 {
     int blocksize;
     /* Check args */
diff --git a/security/nss/lib/freebl/rijndael.h b/security/nss/lib/freebl/rijndael.h
index 397a93545..350d085f8 100644
--- a/security/nss/lib/freebl/rijndael.h
+++ b/security/nss/lib/freebl/rijndael.h
@@ -38,12 +38,12 @@
 
 typedef SECStatus AESFunc(AESContext *cx, unsigned char *output,
                           unsigned int *outputLen, unsigned int maxOutputLen,
-                          unsigned char *input, unsigned int inputLen, 
+                          const unsigned char *input, unsigned int inputLen, 
                           int blocksize);
 
 typedef SECStatus AESBlockFunc(AESContext *cx, 
                                unsigned char *output,
-                               unsigned char *input);
+                               const unsigned char *input);
 
 /* AESContextStr
  *
diff --git a/security/nss/lib/freebl/rsa.c b/security/nss/lib/freebl/rsa.c
index d9279c94a..3940a794a 100644
--- a/security/nss/lib/freebl/rsa.c
+++ b/security/nss/lib/freebl/rsa.c
@@ -116,7 +116,7 @@ rsa_keygen_from_primes(mp_int *p, mp_int *q, mp_int *e, RSAPrivateKey *key,
     /* 1.  Compute n = p*q */
     CHECK_MPI_OK( mp_mul(p, q, &n) );
     /*     verify that the modulus has the desired number of bits */
-    if (mpl_significant_bits(&n) != keySizeInBits) {
+    if ((unsigned)mpl_significant_bits(&n) != keySizeInBits) {
 	PORT_SetError(SEC_ERROR_NEED_RANDOM);
 	rv = SECFailure;
 	goto cleanup;
@@ -277,7 +277,7 @@ rsa_modulusLen(SECItem *modulus)
 SECStatus 
 RSA_PublicKeyOp(RSAPublicKey  *key, 
                 unsigned char *output, 
-                unsigned char *input)
+                const unsigned char *input)
 {
     unsigned int modLen;
     mp_int n, e, m, c;
@@ -590,7 +590,7 @@ cleanup:
 SECStatus 
 RSA_PrivateKeyOp(RSAPrivateKey *key, 
                  unsigned char *output, 
-                 unsigned char *input)
+                 const unsigned char *input)
 {
     unsigned int modLen;
     unsigned int offset;