166719 - crlutil -L crashes with large CRL

Status: VERIFIED FIXED

(NSS :: Libraries, defect, P1)

Description

[Julien Pierre]

After Bob's changes were checked in, there is still a problem dealing with a 26
MB CRL object on OS/2. The CRL is successfully added to the database, but
listing it with crlutil -d . -L crashes with the following stack :

 Function                     | Part           
------------------------------+----------------
 _uheap_check                 | cpprmi36.dll:2 
 _endthread                   | cpprmi36.dll:2 
 free                         | cpprmi36.dll:2 
 PR_Free                      | PRMEM.OBJ      
 PORT_Free                    | SECPORT        
 dbs_freemap                  | DBMSHIM.OBJ    
 dbs_seq                      | DBMSHIM.OBJ    
 certdb_Seq                   | PCERTDB.OBJ    
 nsslowcert_TraverseDBEntries | PCERTDB.OBJ    
 pk11_searchCrls              | PKCS11.OBJ     
 pk11_searchTokenList         | PKCS11.OBJ     
 NSC_FindObjectsInit          | PKCS11.OBJ     
 pk11_FindObjectsByTemplate   | PK11CERT.OBJ   
 PK11_TraverseSlot            | PK11CERT.OBJ   
 pk11_TraverseAllSlots        | PK11CERT.OBJ   
 PK11_LookupCrls              | PK11CERT.OBJ   
 SEC_LookupCrls               | CRL.OBJ        
 ListCRLNames                 | CRLUTIL.OBJ    
 ListCRL                      | CRLUTIL.OBJ    
 main                         | CRLUTIL.OBJ    
 _start                       | EXESTRTI       
 0x1C04C183                   | DOSCALL1.DLL:4 

The problem is in the emulation code for the file mapping function. The pointer
is not being reset to NULL after being freed.

Comment 1

[Julien Pierre]

Attachment: patch to fix crash in file mapping emulation code

Comment 2

[Wan-Teh Chang]

Comment on attachment 97867 [details] [diff] [review]
patch to fix crash in file mapping emulation code

> 	dbs_len = 0;
>     } else if (dbs_addr) {
> 	PORT_Free(dbs_addr);
>+    dbs_addr=NULL;
>     }
>     return;
> }

1. The indentation is wrong.

2. We should also set dbs_len to 0.

Comment 3

[Julien Pierre]

Attachment: updated patch

Comment 4

[Wan-Teh Chang]

Comment on attachment 97871 [details] [diff] [review]
updated patch

r=wtc. Please check it into the tip.  Thanks.

Comment 5

[Julien Pierre]

Checking in dbmshim.c;
/cvsroot/mozilla/security/nss/lib/softoken/dbmshim.c,v  <--  dbmshim.c
new revision: 1.2; previous revision: 1.1
done

Comment 6

[Mike Kaply [:mkaply]]

Julian, please verify this.

Thanks

Comment 7

[Julien Pierre]

This was fixed , but the code is never used at this time since we rolled back
the blob changes. This wasn't an OS/2-specific bug, BTW. Marking verified.