161429 - pk11_CollectCrls could do a partial CRL decode

Status: RESOLVED WONTFIX

(NSS :: Libraries, defect)

Description

[Julien Pierre]

There is no need to do a full decode in this case, since we don't need the
entries while collecting the CRLs. The decoding can be delayed until later at
the time of cert verification.

The only case to fix is when this function gets called from SEC_LookupCrls. In
that case, the list should be enumerated and decoding completed, before the
function returns.

Comment 1

[Julien Pierre]

Actually, SEC_LookupCrls is the only instance of this unexported function
getting called, and since it needs to return a fully decoded CRL, there is
nothing to fix.