165863 - Memory leaks on error paths in nssTrustDomain_FindTrustForCertificate

Status: RESOLVED FIXED

(NSS :: Libraries, defect, P4)

Description

[Wan-Teh Chang]

In trustdomain.c, function nssTrustDomain_FindTrustForCertificate,
'token' is leaked on some error paths.

Here is the code fragment.  'token' is not destroyed if either of
the 'goto loser' statements is taken.  Also, it seems that 'to'
is not destroyed.

        token = nssSlot_GetToken(*slotp);
        if (token) {
            to = nssToken_FindTrustForCertificate(token, NULL,
                                                  &c->encoding,
                                                  &c->issuer,
                                                  &c->serial,
                                              nssTokenSearchType_TokenOnly);
            if (to) {
                if (!pkio) {
                    pkio = nssPKIObject_Create(NULL, to, td, NULL);
                    if (!pkio) {
                        goto loser;
                    }
                } else {
                    status = nssPKIObject_AddInstance(pkio, to);
                    if (status != PR_SUCCESS) {
                        goto loser;
                    }
                }
            }
            nssToken_Destroy(token);
        }

Comment 1

[Ian McGreer]

Attachment: free the token in error paths

"to" is freed, I moved it up to make it more clear in the error paths.

In the success path, "to" becomes part of the PKIObject.  It will be freed with
the PKIObject.

Comment 2

[Ian McGreer]

fixed on tip (3.6)

Comment 3

[Wan-Teh Chang]

Comment on attachment 97637 [details] [diff] [review]
free the token in error paths

r=wtc.