if (data->len > modulusLen ) { return SECFailure; }
rsa_FormatBlock(SECItem *result, unsigned modulusLen,		RSA_BlockType blockType, SECItem *data){    /*     * XXX For now assume that the data length fits in a single     * XXX encryption block; the ASSERTs below force this.     * XXX To fix it, each case will have to loop over chunks whose     * XXX lengths satisfy the assertions, until all data is handled.     * XXX (Unless RSA has more to say about how to handle data     * XXX which does not fit in a single encryption block?)     * XXX And I do not know what the result is supposed to be,     * XXX so the interface to this function may need to change     * XXX to allow for returning multiple blocks, if they are     * XXX not wanted simply concatenated one after the other.     */    switch (blockType) {      case RSA_BlockPrivate0:      case RSA_BlockPrivate:      case RSA_BlockPublic:	/*	 * 0x00 || BT || Pad || 0x00 || ActualData	 *	 * The "3" below is the first octet + the second octet + the 0x00	 * octet that always comes just before the ActualData.	 */	PORT_Assert (data->len <= (modulusLen - (3 + RSA_BLOCK_MIN_PAD_LEN)));	result->data = rsa_FormatOneBlock(modulusLen, blockType, data);	if (result->data == NULL) {	    result->len = 0;	    return SECFailure;	}	result->len = modulusLen;	break;      case RSA_BlockOAEP:	/*	 * 0x00 || BT || M1(Salt) || M2(Pad1||ActualData[||Pad2])	 *	 * The "2" below is the first octet + the second octet.	 * (The other fields do not contain the clear values, but are	 * the same length as the clear values.)	 */	PORT_Assert (data->len <= (modulusLen - (2 + OAEP_SALT_LEN						 + OAEP_PAD_LEN)));	result->data = rsa_FormatOneBlock(modulusLen, blockType, data);	if (result->data == NULL) {	    result->len = 0;	    return SECFailure;	}	result->len = modulusLen;	break;      case RSA_BlockRaw:	/*	 * Pad || ActualData	 * Pad is zeros. The application is responsible for recovering	 * the actual data.	 */	result->data = (unsigned char*)PORT_ZAlloc(modulusLen);	result->len = modulusLen;	PORT_Memcpy(result->data+(modulusLen-data->len),data->data,data->len);	break;      default:	PORT_Assert (0);	result->data = NULL;	result->len = 0;	return SECFailure;    }    return SECSuccess;}