633063 - Uninitialized memory read in CertDB common_FindCertByNicknameOrEmailAddrForUsage

Status: RESOLVED FIXED

(NSS :: Libraries, defect)

Description

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

The variable "cert" might be read without having been assigned. If the unintialized value is non-NULL then the memory it points to will be corrupted by the call to CERT_DestroyCertificate.

common_FindCertByNicknameOrEmailAddrForUsage(CERTCertDBHandle *handle, 
                                             const char *name,
                                             PRBool anyUsage,
                                             SECCertUsage lookingForUsage)
{
    [...]

    CERTCertificate *cert;

    [...] 

    if (anyUsage) {
      cert = PK11_FindCertFromNickname(name, NULL);
    }
    else {
      [...]

      certlist = PK11_FindCertsFromNickname(name, NULL);
      if (certlist) {
        SECStatus rv = CERT_FilterCertListByUsage(certlist, 
                                                  lookingForUsage, 
                                                  PR_FALSE);
        if (SECSuccess == rv &&
            !CERT_LIST_END(CERT_LIST_HEAD(certlist), certlist)) {
          cert = CERT_DupCertificate(CERT_LIST_HEAD(certlist)->cert);
        }
        CERT_DestroyCertList(certlist);
      }
    }

    if (cert) {
	c = get_best_temp_or_perm(ct, STAN_GetNSSCertificate(cert));
	CERT_DestroyCertificate(cert);
	if (ct) {
	    CERT_DestroyCertificate(STAN_GetCERTCertificateOrRelease(ct));

    [...]
}

Comment 1

[Daniel Veditz [:dveditz]]

I can't find any uses of the public entry point CERT_FindCertByNicknameOrEmailAddrForUsage anywhere in the Mozilla tree so it doesn't seem like it could be a security problem that affects us, but could be a problem for any NSS-using app that calls it.

Comment 2

[Kai Engert (:KaiE:)]

This issue has been reported publicly by :decoder in bug 714992, so we could open up this one, too.

Comment 4

[Kai Engert (:KaiE:)]

Attachment: Patch v1

Comment 5

[Robert Relyea]

Comment on attachment 587755 [details] [diff] [review]
Patch v1

r+ rrelyea

Comment 6

[Kai Engert (:KaiE:)]

can we open this bug?


Checking in stanpcertdb.c;
/cvsroot/mozilla/security/nss/lib/certdb/stanpcertdb.c,v  <--  stanpcertdb.c
new revision: 1.89; previous revision: 1.88
done