472291 - crash in libpkix object leak tests due to null pointer dereferencing in pkix_build.c:3218.

Status: RESOLVED FIXED

(NSS :: Libraries, defect, P1)

Description

[Slavomir Katuscak]

Occured on Tinderbox machine communist when running PKIX tests, this machine use special environment variables NSS_ENABLE_PKIX_VERIFY=1 and PKIX_OBJECT_LEAK_TEST=1. This failure occurs there in many vfychain tests on this machine.

From DBX log:
---
Running: vfychain -d AllDB -pp -vv UserBridge.der -t Army
(process id 8976)
RTC: Enabling Error Checking...
RTC: Running program...
t@1 (l@1) signal SEGV (no mapping at the fault address) in pkix_BuildForwardDepthFirstSearch at line 3218 in file "pkix_build.c"
 3218               while (state->parentState) {
---

Comment 1

[Alexei Volkov]

It is a regression introduced by fix for bug 470070.

Should get rid of

3230 PKIX_DECREF(prntState);

since the counter on the object was already decremented by pkix_ForwardBuilderState_Destroy function.

Comment 2

[Alexei Volkov]

Attachment: Remove PKIX_DECREF on prntState object(pkix_build.c:3230)

Comment 3

[Nelson Bolyard (seldom reads bugmail)]

Comment on attachment 355638 [details] [diff] [review]
Remove PKIX_DECREF on prntState object(pkix_build.c:3230)


>-                PKIX_DECREF(prntState);
>+                /* No need to decref the parent state. It was already done by
>+                 * pkix_ForwardBuilderState_Destroy function. */

Where (in what code) and when did pkix_ForwardBuilderState_Destroy get called?
What was the call stack for that call?

Comment 4

[Alexei Volkov]

pkix_ForwardBuilderState_Destroy is called by PKIX_PL_Object_DecRef call before object memory is freed.

Comment 5

[Nelson Bolyard (seldom reads bugmail)]

Comment on attachment 355638 [details] [diff] [review]
Remove PKIX_DECREF on prntState object(pkix_build.c:3230)

r=nelson

Comment 6

[chris hofmann]

did this patch get landed or is it ready to land now?

Comment 7

[Alexei Volkov]

the patch was landed in Jan. Closing the bug...