if (aNestLevel > maxNestLevel)
if (aRelativeNestLevel > maxNestLevel)
MimeCMS_eof (void *crypto_closure, PRBool abort_p){  MimeCMSdata *data = (MimeCMSdata *) crypto_closure;  nsresult rv;  if (!data || !data->output_fn || !data->decoder_context) {  	return -1;  }  // if we are the child of the topmost message, aNestLevel == 1  int aNestLevel = 0;  if (data->self) {    MimeObject *walker = data->self;    while (walker) {      // Crypto mime objects are transparent wrt nesting.      if (!mime_typep(walker, (MimeObjectClass *) &mimeEncryptedClass)          && !mime_typep(walker, (MimeObjectClass *) &mimeMultipartSignedClass)) {        ++aNestLevel;      }      walker = walker->parent;    }  }  /* Hand an EOF to the crypto library.  It may call data->output_fn.	 (Today, the crypto library has no flushing to do, but maybe there	 will be someday.)	 We save away the value returned and will use it later to emit a	 blurb about whether the signature validation was cool.   */  PR_SetError(0, 0);  rv = data->decoder_context->Finish(getter_AddRefs(data->content_info));  if (NS_FAILED(rv))	  data->verify_error = PR_GetError();  data->decoder_context = 0;  nsCOMPtr<nsIX509Cert> certOfInterest;  if (!data->smimeHeaderSink)    return 0;  PRInt32 maxNestLevel = 0;  data->smimeHeaderSink->MaxWantedNesting(&maxNestLevel);  if (aNestLevel > maxNestLevel)    return 0;  PRInt32 status = nsICMSMessageErrors::SUCCESS;  if (data->verify_error      || data->decode_error      || NS_FAILED(rv))  {    status = nsICMSMessageErrors::GENERAL_ERROR;  }  if (!data->content_info)  {    status = nsICMSMessageErrors::GENERAL_ERROR;    // Although a CMS message could be either encrypted or opaquely signed,    // what we see is most likely encrypted, because if it were    // signed only, we probably would have been able to decode it.    data->ci_is_encrypted = PR_TRUE;  }  else  {    rv = data->content_info->ContentIsEncrypted(&data->ci_is_encrypted);    if (NS_SUCCEEDED(rv) && data->ci_is_encrypted) {      data->content_info->GetEncryptionCert(getter_AddRefs(certOfInterest));    }    else {      // Existing logic in mimei assumes, if !ci_is_encrypted, then it is signed.      // Make sure it indeed is signed.      PRBool testIsSigned;      rv = data->content_info->ContentIsSigned(&testIsSigned);      if (NS_FAILED(rv) || !testIsSigned) {        // Neither signed nor encrypted?        // We are unable to understand what we got, do not try to indicate S/Mime status.        return 0;      }      rv = data->content_info->VerifySignature();	    if (NS_FAILED(rv)) {        if (NS_ERROR_MODULE_SECURITY == NS_ERROR_GET_MODULE(rv)) {          status = NS_ERROR_GET_CODE(rv);        }        else if (NS_ERROR_NOT_IMPLEMENTED == rv) {          status = nsICMSMessageErrors::VERIFY_ERROR_PROCESSING;        }      }      else {        PRBool signing_cert_without_email_address;        if (MimeCMSHeadersAndCertsMatch(data->self,											                  data->content_info,											                  &signing_cert_without_email_address,											                  &data->sender_addr))        {          status = nsICMSMessageErrors::SUCCESS;        }        else        {          if (signing_cert_without_email_address) {            status = nsICMSMessageErrors::VERIFY_CERT_WITHOUT_ADDRESS;          }          else {            status = nsICMSMessageErrors::VERIFY_HEADER_MISMATCH;          }        }      }      data->content_info->GetSignerCert(getter_AddRefs(certOfInterest));    }  }  if (data->ci_is_encrypted)  {    data->smimeHeaderSink->EncryptionStatus(      aNestLevel,      status,      certOfInterest    );  }  else  {    data->smimeHeaderSink->SignedStatus(      aNestLevel,      status,      certOfInterest    );  }  return 0;}