425516 - need to destroy data pointed by CERTValOutParam array in case of error

Status: RESOLVED FIXED

(NSS :: Libraries, defect, P1)

Description

[Alexei Volkov]

In case of returned error, a caller of CERT_PKIXVerifyCert does not expect any data to be in CERTValOutParam that otherwise would be related to "normal" execution result. It means that CERT_PKIXVerifyCert should destroy any data pointers that was set before error has occurred.

Comment 1

[Alexei Volkov]

Attachment: Destroy output params in case of error

Comment 2

[Nelson Bolyard (seldom reads bugmail)]

Comment on attachment 312327 [details] [diff] [review]
Destroy output params in case of error

r+ with one change:

>     if (error != NULL) {
>         SECErrorCodes         nssErrorCode = 0;
> 
>+        cert_pkixDestroyValOutParam(paramsOut);
>         cert_PkixErrorToNssCode(error, &nssErrorCode, plContext);
>         PORT_SetError(nssErrorCode);
>         PKIX_PL_Object_DecRef((PKIX_PL_Object *)error, plContext);
>-        /* XXX Destroy output params in case of error. See bug 425516. */
>     }

The new function should be inserted AFTER the call to cert_PkixErrorToNssCode
and BEFORE the call to PORT_SetError.

Comment 3

[Alexei Volkov]

> The new function should be inserted AFTER the call to cert_PkixErrorToNssCode
> and BEFORE the call to PORT_SetError.
Right. Thanks, Nelson. 

Comment 4

[Alexei Volkov]

Patch is integrated.