337101 - Coverity Crash [@ nssPKIObject_Destroy - nssSMIMEProfile_Create] Variable "object" tracked as NULL was passed to a function that dereferences it.

Status: RESOLVED FIXED

(NSS :: Libraries, defect, P2)

Description

[timeless]

Comment 1

[Nelson Bolyard (seldom reads bugmail)]

There are two problems here, both in nssSMIMEProfile_Create(), at about
line 913, if nssPKIObject_Create() returns NULL.
1. arena is leaked.
2. It goes to label loser, where nssPKIObject_Destroy is called with NULL,
   which crashes.

Comment 2

[Nelson Bolyard (seldom reads bugmail)]

Attachment: plug leak, don't crash, v1

Alexei.please review

Comment 3

[Alexei Volkov]

Comment on attachment 222470 [details] [diff] [review]
plug leak, don't crash, v1

if object was created, arena will be destroyed as a part of the destruction process of object. New changes will create double free for arena.

Comment 4

[Nelson Bolyard (seldom reads bugmail)]

Attachment: patch v2

Good catch Alexei. Thanks. Is this better?

Comment 5

[Alexei Volkov]

Comment on attachment 222543 [details] [diff] [review]
patch v2

looks good!

Comment 6

[Nelson Bolyard (seldom reads bugmail)]

Comment on attachment 222470 [details] [diff] [review]
plug leak, don't crash, v1

obsoleting old patch.

Comment 7

[Nelson Bolyard (seldom reads bugmail)]

pki/certificate.c; new revision: 1.58; previous revision: 1.57
pki/certificate.c; new revision: 1.56.2.2; previous revision: 1.56.2.1

Comment 8

[Nelson Bolyard (seldom reads bugmail)]

CID 305