334449 - oom Crash in crmf_template_copy_secalg

Status: RESOLVED FIXED

(NSS :: Libraries, defect, P2)

Description

[timeless]

found by coverity

Comment 1

[timeless]

Attachment: error fast and early

Comment 2

[Nelson Bolyard (seldom reads bugmail)]

Comment on attachment 218793 [details] [diff] [review]
error fast and early

Two issues with this patch:

>-    if (poolp != NULL) {
>-        mark = PORT_ArenaMark(poolp);
>+    if (poolp) {

1. Needs to be:
      if (!poolp) {
2. Needs to set error code
          PORT_SetError(SEC_ERROR_INVALID_ARGS);

>+        return SECFailure;
>     }
>+
>+    mark = PORT_ArenaMark(poolp);
>     *dest = mySecAlg = PORT_ArenaZNew(poolp, SECAlgorithmID);
>     if (mySecAlg == NULL) {
>         goto loser;

Comment 3

[Alexei Volkov]

Attachment: corrected patch

Comment 4

[Nelson Bolyard (seldom reads bugmail)]

Comment on attachment 219157 [details] [diff] [review]
corrected patch

r=nelson

Comment 5

[Alexei Volkov]

tip:
/cvsroot/mozilla/security/nss/lib/crmf/crmfreq.c,v  <--  crmfreq.c
new revision: 1.6; previous revision: 1.5

3.11 branch:
/cvsroot/mozilla/security/nss/lib/crmf/crmfreq.c,v  <--  crmfreq.c
new revision: 1.4.28.2; previous revision: 1.4.28.1

Comment 6

[Nelson Bolyard (seldom reads bugmail)]

CID 210