354403 - nssList_CreateIterator returns pointer to a freed memory if the function fails to allocate a lock

Status: RESOLVED FIXED

(NSS :: Libraries, defect)

Description

[Alexei Volkov]

nss/lib/base/list.c: frees a pointer at list 381, and returns it at 384.

377     if (list->lock) {
378         rvIterator->lock = PZ_NewLock(nssILockOther);
379         if (!rvIterator->lock) {
380             nssList_Destroy(rvIterator->list);
381             nss_ZFreeIf(rvIterator);
382         }
383     }
384     return rvIterator;

Comment 1

[Alexei Volkov]

Attachment: set rvIterator to NULL

Comment 2

[Alexei Volkov]

/cvsroot/mozilla/security/nss/lib/base/list.c,v  <--  list.c
new revision: 1.20; previous revision: 1.19