339913 - Coverity OOM leak in sec_asn1d_add_to_subitems

Status: RESOLVED FIXED

(NSS :: Libraries, defect, P2)

Description

[Nelson Bolyard (seldom reads bugmail)]

Coverity CID 296.

In file nss/lib/util/secasn1d.c, in function sec_asn1d_add_to_subitems,
if  sec_asn1d_alloc gets assigned NULL (returned by sec_asn1d_alloc()),
then the function returns without freeing "thing".

Comment 1

[Nelson Bolyard (seldom reads bugmail)]

I surely mistyped that description. 
I meant that if "thing" gets allocated, but then "copy" does not 
(gets NUL), the funtion returns without freeing "thing".
That's what CID 296 reports. 

I think the writer of this function assumed that state->top->our_pool
would always be non-NULL, but we know that is not always true, and 
that the decoder is sometimes used without an arenapool.  
So, the correct code should free "thing" if "copy" is NULL, AND 
state->top->our_pool is NULL.

Comment 2

[Nelson Bolyard (seldom reads bugmail)]

Attachment: patch v1

Comment 3

[Alexei Volkov]

Comment on attachment 224826 [details] [diff] [review]
patch v1

r=alexei

Comment 4

[Nelson Bolyard (seldom reads bugmail)]

Fix leak in sec_asn1d_add_to_subitems.  Bug 339913. r=alexei.volkov

Checking in secasn1d.c; new revision: 1.33.28.2; previous revision: 1.33.28.1
Checking in secasn1d.c; new revision: 1.35;      previous revision: 1.34