The default bug view has changed. See this FAQ.

incorrect list element count in PKIX_List_AppendItem function

RESOLVED FIXED in 3.12.1

Status

NSS
Libraries
P2
normal
RESOLVED FIXED
9 years ago
9 years ago

People

(Reporter: Alexei Volkov, Assigned: Alexei Volkov)

Tracking

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: PKIX)

Attachments

(1 attachment)

(Assignee)

Description

9 years ago
PKIX_List structure is the single linked list of PKIX_List object. The head structure keeps count of elements in the list.

PKIX_List_AppendItem increments count at the end of function upon success. If PKIX_INCREF(item) returns error, new member(object of PKIX_List structure) will be added to the list, but the count will not be incremented and so the object will be leaked. 

Here is the code:
        lastElement = list;
        for (i = 0; i < length; i++){
                lastElement = lastElement->next;
        }

        PKIX_CHECK(pkix_List_Create_Internal
                    (PKIX_FALSE, &lastElement->next, plContext),
                    PKIX_LISTCREATEINTERNALFAILED);

        PKIX_INCREF(item);
        newElement->item = item;

        PKIX_CHECK(PKIX_PL_Object_InvalidateCache
                    ((PKIX_PL_Object *)list, plContext),
                    PKIX_OBJECTINVALIDATECACHEFAILED);

       list->length = list->length + 1;
(Assignee)

Comment 1

9 years ago
Created attachment 325592 [details] [diff] [review]
Add new member to the list only upon success.
Attachment #325592 - Flags: review?(nelson)
Comment on attachment 325592 [details] [diff] [review]
Add new member to the list only upon success.

r=nelson
Attachment #325592 - Flags: review?(nelson) → review+
(Assignee)

Comment 3

9 years ago
Patch integrated.
Status: NEW → RESOLVED
Last Resolved: 9 years ago
Resolution: --- → FIXED
(Assignee)

Updated

9 years ago
Priority: -- → P2
Whiteboard: PKIX
Target Milestone: --- → 3.12.1
You need to log in before you can comment on or make changes to this bug.