156801 - pk11_CollectCrls crashes if CERT_DecodeDERCrl returns a NULL pointer.

Status: RESOLVED FIXED

(NSS :: Libraries, defect)

Description

[Wan-Teh Chang]

This bug is reported by Robert List in the mozilla.crypto
newsgroup.

pk11_CollectCrls crashes if CERT_DecodeDERCrl returns
a NULL pointer.  Here is the relevant code snippet:

static SECStatus
pk11_CollectCrls(PK11SlotInfo *slot, CK_OBJECT_HANDLE crlID, void *arg)
{
...
    new_node->crl=CERT_DecodeDERCrl(head->arena,&derCrl,new_node->type);
    if (new_node->crl == NULL) {
        goto loser;
    }

    if (fetchCrl[2].pValue) {
        int nnlen = fetchCrl[2].ulValueLen;
        new_node->crl->url  = (char *)PORT_ArenaAlloc(head->arena, nnlen+1);

If CERT_DecodeDERCrl returns a NULL pointer, we get an access
violation on dereferencing new_node->crl->url.

Comment 1

[Wan-Teh Chang]

This is fixed on the tip, in rev. 1.87 of pk11cert.c.

There is an error in the code snippet I provided.
Actually, the code after the CERT_DecodeDERCrl call:

    if (new_node->crl == NULL) {
        goto loser;
    }

is the fix and was not there originally :-)  Sorry
about the confusion.

Comment 2

[Wan-Teh Chang]

Attachment: The fix

Comment 3

[Asa Dotzler [:asa]]

a=asa (on behalf of drivers) for checkin to 1.1

Comment 4

[Wan-Teh Chang]

I checked in the fix into NSS_3_5_BRANCH and NSS_CLIENT_TAG.