Bug 459231 - Memory leak in cert fetching - AIA extension. r=nelson

3 files changed, 32 insertions, 11 deletions

diff --git a/security/nss/lib/libpkix/pkix_pl_nss/module/pkix_pl_aiamgr.c b/security/nss/lib/libpkix/pkix_pl_nss/module/pkix_pl_aiamgr.c
index 707e94c9e..e2bf7f14f 100644
--- a/security/nss/lib/libpkix/pkix_pl_nss/module/pkix_pl_aiamgr.c
+++ b/security/nss/lib/libpkix/pkix_pl_nss/module/pkix_pl_aiamgr.c
@@ -331,9 +331,6 @@ pkix_pl_AIAMgr_GetHTTPCerts(
                         	&requestSession));
 
                 	if (rv != SECSuccess) {
-                        	if (path != NULL) {
-                                	PORT_Free(path);
-                        	}
                         	PKIX_ERROR(PKIX_HTTPSERVERERROR);
                 	}
 
@@ -415,6 +412,12 @@ cleanup:
         if (locationAscii) {
             PORT_Free(locationAscii);
         }
+        if (hostname) {
+            PORT_Free(hostname);
+        }
+        if (path) {
+            PORT_Free(path);
+        }
 
         PKIX_RETURN(AIAMGR);
 }
diff --git a/security/nss/lib/libpkix/pkix_pl_nss/module/pkix_pl_httpdefaultclient.c b/security/nss/lib/libpkix/pkix_pl_nss/module/pkix_pl_httpdefaultclient.c
index 30b2a53c7..321857beb 100644
--- a/security/nss/lib/libpkix/pkix_pl_nss/module/pkix_pl_httpdefaultclient.c
+++ b/security/nss/lib/libpkix/pkix_pl_nss/module/pkix_pl_httpdefaultclient.c
@@ -410,7 +410,7 @@ pkix_pl_HttpDefaultClient_Create(
         PKIX_PL_HttpDefaultClient *client = NULL;
 
         PKIX_ENTER(HTTPDEFAULTCLIENT, "PKIX_PL_HttpDefaultClient_Create");
-        PKIX_NULLCHECK_ONE(pClient);
+        PKIX_NULLCHECK_TWO(pClient, host);
 
         /* allocate an HttpDefaultClient */
         PKIX_CHECK(PKIX_PL_Object_Alloc
@@ -439,7 +439,12 @@ pkix_pl_HttpDefaultClient_Create(
         client->GETBuf = NULL;
         client->POSTBuf = NULL;
         client->rcvBuf = NULL;
-        client->host = host;
+        /* "host" is a parsing result by CERT_GetURL function that adds
+         * "end of line" to the value. OK to dup the string. */
+        client->host = PORT_Strdup(host);
+        if (!client->host) {
+            PKIX_ERROR(PKIX_ALLOCERROR);
+        }
         client->path = NULL;
         client->rcvContentType = NULL;
         client->rcvHeaders = NULL;
@@ -495,17 +500,22 @@ pkix_pl_HttpDefaultClient_Destroy(
                 PR_smprintf_free(client->GETBuf);
                 client->GETBuf = NULL;
         }
-
         if (client->POSTBuf != NULL) {
                 PKIX_PL_Free(client->POSTBuf, plContext);
                 client->POSTBuf = NULL;
         }
-
         if (client->rcvBuf != NULL) {
                 PKIX_PL_Free(client->rcvBuf, plContext);
                 client->rcvBuf = NULL;
         }
-
+        if (client->host) {
+                PORT_Free(client->host);
+                client->host = NULL;
+        }
+        if (client->path) {
+                PORT_Free(client->path);
+                client->path = NULL;
+        }
         PKIX_DECREF(client->socket);
 
 cleanup:
@@ -1254,7 +1264,15 @@ pkix_pl_HttpDefaultClient_RequestCreate(
                 PKIX_ERROR(PKIX_UNRECOGNIZEDREQUESTMETHOD);
         }
 
-        client->path = path_and_query_string;
+        if (path_and_query_string) {
+            /* "path_and_query_string" is a parsing result by CERT_GetURL
+             * function that adds "end of line" to the value. OK to dup
+             * the string. */
+            client->path = PORT_Strdup(path_and_query_string);
+            if (!client->path) {
+                PKIX_ERROR(PKIX_ALLOCERROR);
+            }
+        }
 
         client->timeout = timeout;
 
diff --git a/security/nss/lib/libpkix/pkix_pl_nss/module/pkix_pl_httpdefaultclient.h b/security/nss/lib/libpkix/pkix_pl_nss/module/pkix_pl_httpdefaultclient.h
index 918959f04..70b408cae 100644
--- a/security/nss/lib/libpkix/pkix_pl_nss/module/pkix_pl_httpdefaultclient.h
+++ b/security/nss/lib/libpkix/pkix_pl_nss/module/pkix_pl_httpdefaultclient.h
@@ -91,8 +91,8 @@ struct PKIX_PL_HttpDefaultClientStruct {
         char *GETBuf;
         char *POSTBuf;
         char *rcvBuf;
-        const char *host;
-        const char *path;
+        char *host;
+        char *path;
         const char *rcvContentType;
         void *rcvHeaders;
         HttpMethod send_http_method;