1209541 - [Coverity 1078803] Leak of memory or pointers to system resources in NSS_CMSSignerInfo_Verify

Status: RESOLVED FIXED

(NSS :: Libraries, defect)

Description

[Tim Taubert [:ttaubert] (inactive)]

> if ((poolp = PORT_NewArena (1024)) == NULL) {
>     vs = NSSCMSVS_ProcessingError;
>     goto loser;
> }
> 
> encoded_attrs.data = NULL;
> encoded_attrs.len = 0;
> 
> if (NSS_CMSAttributeArray_Encode(poolp, &(signerinfo->authAttr),
>                                  &encoded_attrs) == NULL ||
>     encoded_attrs.data == NULL || encoded_attrs.len == 0) {
>     vs = NSSCMSVS_ProcessingError;
>     goto loser;
> }
> 
> vs = (VFY_VerifyDataDirect(encoded_attrs.data, encoded_attrs.len,
>                            publickey, &(signerinfo->encDigest), pubkAlgTag,
>                            digestalgtag, NULL, signerinfo->cmsg->pwfn_arg) != SECSuccess)
>       ? NSSCMSVS_BadSignature : NSSCMSVS_GoodSignature;
> 
> PORT_FreeArena(poolp, PR_FALSE);  /* awkward memory management :-( */

11. alloc_fn: Storage is returned from allocation function PORT_NewArena_Util.

12. var_assign: Assigning: poolp = storage returned from PORT_NewArena_Util(1024UL).

14. noescape: Resource poolp is not freed or pointed-to in NSS_CMSAttributeArray_Encode.

18. leaked_storage: Variable poolp going out of scope leaks the storage it points to.

Comment 1

[Tim Taubert [:ttaubert] (inactive)]

Patch at: https://codereview.appspot.com/264540043

Comment 2

[Eric Rescorla (:ekr)]

LGTM

Comment 3

[Martin Thomson [:mt:]]

https://hg.mozilla.org/projects/nss/rev/330c55448872