334454 - Variable "(key)->pkcs11Slot" tracked as NULL was passed to a function that dereferences it. [@ SECKEY_CopyPrivateKey - SSL_ConfigSecureServer]

Status: RESOLVED FIXED

(NSS :: Libraries, defect, P2)

Description

[timeless]

found by coverity

Comment 1

[Alexei Volkov]

Attachment: verify that slot is not null

Comment 2

[Nelson Bolyard (seldom reads bugmail)]

Comment on attachment 219769 [details] [diff] [review]
verify that slot is not null

r=nelson, when you make the following edits:

>Index: seckey.c
>===================================================================
>RCS file: /cvsroot/mozilla/security/nss/lib/cryptohi/seckey.c,v
>retrieving revision 1.40
>diff -U10 -r1.40 seckey.c
>--- seckey.c	25 Apr 2006 02:23:52 -0000	1.40
>+++ seckey.c	25 Apr 2006 17:17:54 -0000
>@@ -1493,21 +1493,21 @@
>     }
>     return 0;
> }
> 
> SECKEYPrivateKey *
> SECKEY_CopyPrivateKey(const SECKEYPrivateKey *privk)
> {
>     SECKEYPrivateKey *copyk;
>     PRArenaPool *arena;
>     
>-    if (privk == NULL) {
>+    if (!privk || !privk->pkcs11Slot) {

Here, add
 +      PORT_SetError(SEC_ERROR_INVALID_ARGS);

> 	return NULL;
>     }
>     
>     arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
>     if (arena == NULL) {
> 	PORT_SetError (SEC_ERROR_NO_MEMORY);

Check that PORT_NewArena sets that error code, and then remove 
that redundant PORT_SetError call.

> 	return NULL;
>     }

Comment 3

[Alexei Volkov]

tip:
/cvsroot/mozilla/security/nss/lib/cryptohi/seckey.c,v  <--  seckey.c
new revision: 1.41; previous revision: 1.40

3.11 branch:
/cvsroot/mozilla/security/nss/lib/cryptohi/seckey.c,v  <--  seckey.c
new revision: 1.36.2.5; previous revision: 1.36.2.4

Comment 4

[Alexei Volkov]

3.11.1 branch:
/cvsroot/mozilla/security/nss/lib/cryptohi/seckey.c,v  <--  seckey.c
new revision: 1.36.2.4.2.1; previous revision: 1.36.2.4

Comment 5

[Nelson Bolyard (seldom reads bugmail)]

CID 208