403795 - Verify lifetime of PKIX_PL_OcspRequest vs PKIX_PL_OcspResponse

Status: RESOLVED INVALID

(NSS :: Libraries, defect, P1)

Description

[Kai Engert (:KaiE:)]

Function pkix_pl_OcspResponse_Create
uses pkix_pl_OcspRequest_GetCertID
to obtain a pointer to a CERTOCSPCertID
and stores it as a member of the new response object.

Is the request object guaranteed to life at least as long as the response object?

If the request object could get freed earlier, the response object might carry a dangling pointer.

If that's possible to happen, it shouldn't reference the simple pointer, but make a deep copy.

Comment 1

[Kai Engert (:KaiE:)]

Thoughts welcome, although I might fix this when working on bug 375019.

Comment 2

[Alexei Volkov]

pkix_OcspChecker_Check is the function to look at. OCSP request object get freed (with associated responds object) after all operation are finished and ocsp revocation status is know. IMO, it is save to use CERTOCSPCertID in this case.

Comment 3

[Alexei Volkov]

Reference count to request data get incremented before saving the pointer in to request member of response data structure. The pointer will be decremented at the response destruction time. It is safe to use.

Closing bug as invalid.