505820 - nssTokenObjectCache_Create leaks rvCache if PZ_NewLock fails

Status: RESOLVED FIXED

(NSS :: Libraries, defect, P2)

Description

[timeless]

253     rvCache = nss_ZNEW(NULL, nssTokenObjectCache);

257 rvCache->lock = PZ_NewLock(nssILockOther); /* XXX */
258 if (!rvCache->lock) {
259 goto loser;

266 loser:
267 return (nssTokenObjectCache *)NULL;

Comment 1

[Shailen]

Attachment: Patch V 1

Hi Nelson,

   Please review the patch.

Thanks,
Shailendra

Comment 2

[Nelson Bolyard (seldom reads bugmail)]

Comment on attachment 437016 [details] [diff] [review]
Patch V 1

One of the paths to loser leaves rvCache->lock as NULL.
If you call nssTokenObjectCache_Destroy with rvCache->lock being NULL
it will call PR_DestroyLock with NULL, which will crash.  
(PZ_DestroyLock is just a wrapper for PR_DestroyLock)

The solution to this problem, IMO, is to fix 
nssTokenObjectCache_Destroy so that it does not call PZ_DestroyLock 
if cache->lock is NULL.  
When your patch also does that, it will be complete.

> loser:
>+    nssTokenObjectCache_Destroy(rvCache);
>     return (nssTokenObjectCache *)NULL;
> }
> 
> static void
> clear_cache (
>   nssTokenObjectCache *cache
> )
> {

Comment 3

[Shailen]

Attachment: Patch Version 2

Hi Nelson,

  I have made the required changes in this new patch.

Regards,
Shailendra

Comment 4

[Nelson Bolyard (seldom reads bugmail)]

Comment on attachment 437267 [details] [diff] [review]
Patch Version 2

r=nelson

Comment 5

[Nelson Bolyard (seldom reads bugmail)]

Bug 505820: nssTokenObjectCache_Create leaks rvCache if PZ_NewLock fails
Patch by Shailendra Jain <[e-mail]>, r=nelson

Checking in nss/lib/dev/devutil.c; new revision: 1.35; previous revision: 1.34

Thanks, Shailendra