Last Comment Bug 414985 - Crash in pkix_pl_OcspRequest_Destroy
: Crash in pkix_pl_OcspRequest_Destroy
Status: RESOLVED FIXED
:
Product: NSS
Classification: Components
Component: Libraries (show other bugs)
: 3.12
: All All
: -- normal (vote)
: 3.12
Assigned To: Alexei Volkov
:
:
Mentors:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2008-01-30 16:04 PST by Alexei Volkov
Modified: 2008-01-31 10:45 PST (History)
0 users
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---


Attachments
Init certList and location (3.54 KB, patch)
2008-01-30 16:06 PST, Alexei Volkov
nelson: review+
Details | Diff | Splinter Review

Description Alexei Volkov 2008-01-30 16:04:02 PST
Crash in libpkix when requesting ocsp revocation chain on a cert that does not have AIA extension.

The crash happened because of two fields of pkix_pl_ocsprequest data type was not initialized before destruction. They are certList and location.
Comment 1 Alexei Volkov 2008-01-30 16:06:23 PST
Created attachment 300525 [details] [diff] [review]
Init certList and location

The patch also fixes some potential leaks in CERT_PKIXVerifyCert function.
Comment 2 Nelson Bolyard (seldom reads bugmail) 2008-01-30 20:16:21 PST
Comment on attachment 300525 [details] [diff] [review]
Init certList and location

r=nelson
Comment 3 Alexei Volkov 2008-01-31 10:45:14 PST
/cvsroot/mozilla/security/nss/lib/certhigh/certvfypkix.c,v  <--  certvfypkix.c
new revision: 1.10; previous revision: 1.9
Checking in lib/libpkix/pkix_pl_nss/pki/pkix_pl_ocsprequest.c;
new revision: 1.7; previous revision: 1.6

Note You need to log in before you can comment on or make changes to this bug.