337085 - Coverity 447, dead code in mozilla/security/nss/lib/certhigh/ocsp.c

Status: RESOLVED FIXED

(NSS :: Libraries, defect, P3)

Description

[Jon Smirl]

This one is a buglet, strdup can fail and the result wasn't checked.

diff -u -r1.21.2.3 ocsp.c
--- security/nss/lib/certhigh/ocsp.c    3 Apr 2006 20:15:40 -0000       1.21.2.3
+++ security/nss/lib/certhigh/ocsp.c    8 May 2006 04:33:28 -0000
@@ -1755,6 +1755,8 @@
        path[len] = '\0';
     } else {
        path = PORT_Strdup("/");
+       if (path == NULL)
+           goto loser;
     }

     *pHostname = hostname;
@@ -1765,8 +1767,6 @@
 loser:
     if (hostname != NULL)
        PORT_Free(hostname);
-    if (path != NULL)
-       PORT_Free(path);
     PORT_SetError(SEC_ERROR_CERT_BAD_ACCESS_LOCATION);
     return SECFailure;
 }

Comment 1

[Jon Smirl]

Attachment: check error return on strdup

Comment 2

[Alexei Volkov]

trunk
/cvsroot/mozilla/security/nss/lib/certhigh/ocsp.c,v  <--  ocsp.c
new revision: 1.24; previous revision: 1.23

3.11 branch
/cvsroot/mozilla/security/nss/lib/certhigh/ocsp.c,v  <--  ocsp.c
new revision: 1.21.2.5; previous revision: 1.21.2.4

Comment 3

[Nelson Bolyard (seldom reads bugmail)]

Also CID 844