352041 - oom [@ CERT_DecodeDERCrlWithFlags] "extended" tracked as NULL was dereferenced.

Status: RESOLVED FIXED

(NSS :: Libraries, defect, P2)

Description

[timeless]

Comment 1

[Nelson Bolyard (seldom reads bugmail)]

In function CERT_DecodeDERCrlWithFlags, 
when called with option CRL_DECODE_ADOPT_HEAP_DER = 1
        and with option CRL_DECODE_KEEP_BAD_CRL   = 1
        and with option CRL_DECODE_DONT_COPY_DER  = 0,
and  called with narena == NULL,

if the attempt to allocate crl from the arena fails,
then at label loser, we dereference a NULL pointer, 
the variable "extended", in this code:

571  	loser:
572  	    if (options & CRL_DECODE_KEEP_BAD_CRL) {
573  	        extended->decodingError = PR_TRUE;     <<-- crash
574  	        crl->referenceCount = 1;
575  	        return(crl);
576  	    }

Comment 2

[Julien Pierre]

Attachment: Fix crash if extended is NULL . Also handle crl NULL case properly

Comment 3

[Alexei Volkov]

Comment on attachment 237819 [details] [diff] [review]
Fix crash if extended is NULL . Also handle crl NULL case properly

r=alexei.volkov

Comment 4

[Julien Pierre]

Checked in to the tip :

Checking in crl.c;
/cvsroot/mozilla/security/nss/lib/certdb/crl.c,v  <--  crl.c
new revision: 1.54; previous revision: 1.53

And NSS_3_11_BRANCH :

Checking in crl.c;
/cvsroot/mozilla/security/nss/lib/certdb/crl.c,v  <--  crl.c
new revision: 1.49.24.4; previous revision: 1.49.24.3
done