571251 - sftk_parseParameters calls PORT_Free(tmp) on unitialized pointer

Status: RESOLVED FIXED

(NSS :: Libraries, defect, P1)

Description

[Elio Maldonado]

Extract from
http://mxr.mozilla.org/security/source/security/nss/lib/softoken/sftkpars.c#413
shows

416        char *tmp;
......
446         SFTK_HANDLE_STRING_ARG(index,tmp,"flags=", 
447                 if(tmp) { sftk_parseFlags(param,parsed); PORT_Free(tmp); })
448         SFTK_HANDLE_STRING_ARG(index,tmp,"tokens=", 
449                 if(tmp) { sftk_parseTokens(tmp,parsed); PORT_Free(tmp); })
....

if(tmp) may be non-zero because of random values on teh stack for tmp. It should be set to NULL at line 416.

Kamil Dudka reported similar problem a PEM module code review at
https://bugzilla.mozilla.org/show_bug.cgi?id=402712#c45

Comment 1

[Elio Maldonado]

Attachment: initialize pointer to null

Comment 2

[Elio Maldonado]

Attachment: set tmp to NULL

Comment 3

[Robert Relyea]

Comment on attachment 450368 [details] [diff] [review]
set tmp to NULL

r+ (We may have a patch like this already in 3.13 branch.

bob

Comment 4

[Elio Maldonado]

(In reply to comment #3)
> (From update of attachment 450368 [details] [diff] [review])
> r+ (We may have a patch like this already in 3.13 branch.
> 
Indeed, see https://bugzilla.mozilla.org/show_bug.cgi?id=469585
the patch that was applied on the 3.13 branch is more complete than this one.

Comment 5

[Elio Maldonado]

Attachment: Complete fix

Better patch that was applied on the 3.13 branch.

Comment 6

[Nelson Bolyard (seldom reads bugmail)]

Comment on attachment 450665 [details] [diff] [review]
Complete fix

I think Elio meant to ask Bob for this review.

Comment 7

[Robert Relyea]

Comment on attachment 450665 [details] [diff] [review]
Complete fix

r+ looks familiar;).

bob

Comment 8

[Elio Maldonado]

Fix was checked in: Checking in mozilla/security/nss/lib/softoken/sftkpars.c;
/cvsroot/mozilla/security/nss/lib/softoken/sftkpars.c,v  <--  sftkpars.c
new revision: 1.11; previous revision: 1.10