353773 - klocwork Null ptr dereferences in pk11nobj.c

Status: RESOLVED FIXED

(NSS :: Libraries, defect, P2)

Description

[Nelson Bolyard (seldom reads bugmail)]

ID:       92202
Function: SEC_DeletePermCRL
Location: nss/lib/pk11wrap/pk11nobj.c : 550

Pointer 'object' returned from call to function 'nss_ZAlloc' at line 549 
may be NULL and will be dereferenced at line 550.

549	    object = nss_ZNEW(NULL, nssCryptokiObject); 
550	    object->token = nssToken_AddRef(token); 
551	    object->handle = crl->pkcs11ID; 
552	    object->isTokenObject = PR_TRUE; 

----

ID:       88551
Function: PK11_FindSMimeProfile
Location: nss/lib/pk11wrap/pk11nobj.c : 602

Pointer 'list' returned from call to function 'PK11_GetAllTokens' at 
line 597 may be NULL and will be dereferenced at line 602.

597		PK11SlotList *list = PK11_GetAllTokens(CKM_INVALID_MECHANISM, 
598						PR_FALSE,PR_TRUE,NULL); 
599		PK11SlotListElement *le; 
602		for (le = list->head; le; le = le->next) {

Comment 1

[Alexei Volkov]

Attachment: fixes

Comment 2

[Nelson Bolyard (seldom reads bugmail)]

Comment on attachment 241192 [details] [diff] [review]
fixes

If PK11_GetAllTokens returns NULL, that is a fatal error in itself. 
In that case, we should return NULL right away, without setting a
diffrent error code, such as SEC_ERROR_NO_KRL.

Comment 3

[Alexei Volkov]

Attachment: do not change error code returned by PK11_GetAllTokens

Comment 4

[Nelson Bolyard (seldom reads bugmail)]

Comment on attachment 241202 [details] [diff] [review]
do not change error code returned by PK11_GetAllTokens

r=nelson for trunk

Comment 5

[Alexei Volkov]

/cvsroot/mozilla/security/nss/lib/pk11wrap/pk11nobj.c,v  <--  pk11nobj.c
new revision: 1.8; previous revision: 1.7