data->smimeHeaderSink->MaxWantedNesting(&maxNestLevel);
if (aRelativeNestLevel >= 0) { data->smimeHeaderSink->MaxWantedNesting(&maxNestLevel);
MimeMultCMS_generate (void *crypto_closure){  MimeMultCMSdata *data = (MimeMultCMSdata *) crypto_closure;  PRBool signed_p = PR_TRUE;  PRBool good_p = PR_FALSE;  PRBool encrypted_p;  PRBool unverified_p = PR_FALSE;  nsresult rv;  if (!data) return 0;  encrypted_p = data->parent_is_encrypted_p;  PRInt32 signature_status = nsICMSMessageErrors::GENERAL_ERROR;  nsCOMPtr<nsIX509Cert> signerCert;  // if we are the child of the topmost message, aNestLeve == 1  int aNestLevel = 0;  if (data->self) {    MimeObject *walker = data->self;    while (walker) {      // Crypto mime objects are transparent wrt nesting.      if (!mime_typep(walker, (MimeObjectClass *) &mimeEncryptedClass)          && !mime_typep(walker, (MimeObjectClass *) &mimeMultipartSignedClass)) {        ++aNestLevel;      }      walker = walker->parent;    }  }  unverified_p = data->self->options->missing_parts;   if (unverified_p)  {    // We were not given all parts of the message.    // We are therefore unable to verify correctness of the signature.    signature_status = nsICMSMessageErrors::VERIFY_NOT_YET_ATTEMPTED;  }  else  if (data->content_info)	{	  rv = data->content_info->VerifyDetachedSignature(data->item_data, data->item_len);    data->content_info->GetSignerCert(getter_AddRefs(signerCert));	  if (NS_FAILED(rv)) {      if (NS_ERROR_MODULE_SECURITY == NS_ERROR_GET_MODULE(rv)) {        signature_status = NS_ERROR_GET_CODE(rv);      }            if (!data->verify_error) {        data->verify_error = PR_GetError();      }      if (data->verify_error >= 0) {        data->verify_error = -1;      }    } else {		  PRBool signing_cert_without_email_address;		  good_p = MimeCMSHeadersAndCertsMatch(data->self,												 data->content_info,												 &signing_cert_without_email_address,												 &data->sender_addr);      if (!good_p) {        if (signing_cert_without_email_address) {          signature_status = nsICMSMessageErrors::VERIFY_CERT_WITHOUT_ADDRESS;        }        else {          signature_status = nsICMSMessageErrors::VERIFY_HEADER_MISMATCH;        }        if (!data->verify_error) {          data->verify_error = -1;          // XXX Fix this		data->verify_error = SEC_ERROR_CERT_ADDR_MISMATCH; XXX //        }      }      else       {        signature_status = nsICMSMessageErrors::SUCCESS;      }    }#if 0 // XXX Fix this. What do we do here? //	  if (SEC_CMSContainsCertsOrCrls(data->content_info))    {		  /* #### call libsec telling it to import the certs */    }#endif	  /* Don't free these yet -- keep them around for the lifetime of the		 MIME object, so that we can get at the security info of sub-parts		 of the currently-displayed message. */#if 0	  SEC_CMSDestroyContentInfo(data->content_info);	  data->content_info = 0;#endif /* 0 */	}  else	{	  /* No content_info at all -- since we're inside a multipart/signed,		 that means that we've either gotten a message that was truncated		 before the signature part, or we ran out of memory, or something		 awful has happened.  Anyway, it sure ain't good_p.	   */	}  PRInt32 maxNestLevel = 0;  if (data->smimeHeaderSink) {    data->smimeHeaderSink->MaxWantedNesting(&maxNestLevel);    if (aNestLevel <= maxNestLevel)    {      data->smimeHeaderSink->SignedStatus(aNestLevel, signature_status, signerCert);    }  }  if (data->self && data->self->parent) {    mime_set_crypto_stamp(data->self->parent, signed_p, encrypted_p);  }  {    char *stamp_url = 0, *result;    if (data->self)    {      if (unverified_p && data->self->options) {		    // XXX Fix this stamp_url = IMAP_CreateReloadAllPartsUrl(data->self->options->url); XXX //      } else {        stamp_url = MimeCMS_MakeSAURL(data->self);      }    }    result =	    MimeHeaders_make_crypto_stamp (encrypted_p, signed_p, good_p,        unverified_p,        data->parent_holds_stamp_p,        stamp_url);    PR_FREEIF(stamp_url);    return result;  }}