165859 - Double free on error path in nssTrustDomain_FindCertificateByIssuerAndSerialNumber

Status: RESOLVED FIXED

(NSS :: Libraries, defect)

Description

[Wan-Teh Chang]

In trustdomain.c, function
nssTrustDomain_FindCertificateByIssuerAndSerialNumber,
'collection' may be destroyed twice if the
nssPKIObjectCollection_GetCertificates call fails.

Here is the code fragment:

    if (collection) {
        (void)nssPKIObjectCollection_GetCertificates(collection,
                                                     &rvCert, 1, NULL);
        nssPKIObjectCollection_Destroy(collection);
        if (!rvCert) {
            goto loser;
        }
    }
    nssSlotArray_Destroy(slots);
    return rvCert;
loser:
    if (collection) {
        nssPKIObjectCollection_Destroy(collection);
    }
    if (slots) {
        nssSlotArray_Destroy(slots);
    }
    return (NSSCertificate *)NULL;

Comment 1

[Wan-Teh Chang]

Attachment: Proposed patch

Comment 2

[Wan-Teh Chang]

Fix checked into the tip.  This bug seems to have been
introduced in NSS 3.5.