440062 - incorrect list element count in PKIX_List_AppendItem function

Status: RESOLVED FIXED

(NSS :: Libraries, defect, P2)

Description

[Alexei Volkov]

PKIX_List structure is the single linked list of PKIX_List object. The head structure keeps count of elements in the list.

PKIX_List_AppendItem increments count at the end of function upon success. If PKIX_INCREF(item) returns error, new member(object of PKIX_List structure) will be added to the list, but the count will not be incremented and so the object will be leaked. 

Here is the code:
        lastElement = list;
        for (i = 0; i < length; i++){
                lastElement = lastElement->next;
        }

        PKIX_CHECK(pkix_List_Create_Internal
                    (PKIX_FALSE, &lastElement->next, plContext),
                    PKIX_LISTCREATEINTERNALFAILED);

        PKIX_INCREF(item);
        newElement->item = item;

        PKIX_CHECK(PKIX_PL_Object_InvalidateCache
                    ((PKIX_PL_Object *)list, plContext),
                    PKIX_OBJECTINVALIDATECACHEFAILED);

       list->length = list->length + 1;

Comment 1

[Alexei Volkov]

Attachment: Add new member to the list only upon success.

Comment 2

[Nelson Bolyard (seldom reads bugmail)]

Comment on attachment 325592 [details] [diff] [review]
Add new member to the list only upon success.

r=nelson

Comment 3

[Alexei Volkov]

Patch integrated.