Arg.. version 1.63 was a misapplied patch, (supposed to be checked into the

3.5 branch). The result is 1.63 backs out 1.62, which is not the intent.
restore 1.62.

1 files changed, 20 insertions, 11 deletions

diff --git a/security/nss/lib/pki/pki3hack.c b/security/nss/lib/pki/pki3hack.c
index 3757aa79f..c26cc927b 100644
--- a/security/nss/lib/pki/pki3hack.c
+++ b/security/nss/lib/pki/pki3hack.c
@@ -433,18 +433,27 @@ nssDecodedPKIXCertificate_Destroy
 )
 {
     CERTCertificate *cert = (CERTCertificate *)dc->data;
-    PRBool freeSlot = cert->ownSlot;
-    PK11SlotInfo *slot = cert->slot;
-    PRArenaPool *arena  = cert->arena;
-    /* zero cert before freeing. Any stale references to this cert
-     * after this point will probably cause an exception.  */
-    PORT_Memset(cert, 0, sizeof *cert);
-    /* free the arena that contains the cert. */
-    PORT_FreeArena(arena, PR_FALSE);
-    nss_ZFreeIf(dc);
-    if (slot && freeSlot) {
-	PK11_FreeSlot(slot);
+    PRBool freeSlot = PR_FALSE; 
+    PK11SlotInfo *slot = NULL;
+    PRArenaPool *arena;
+
+    /* The decoder may only be half initialized (the case where we find we 
+     * could not decode the certificate). In this case, there is not cert to
+     * free, just free the dc structure. */
+    if (cert) {
+	freeSlot = cert->ownSlot;
+	slot = cert->slot;
+	arena  = cert->arena;
+	/* zero cert before freeing. Any stale references to this cert
+	 * after this point will probably cause an exception.  */
+	PORT_Memset(cert, 0, sizeof *cert);
+	/* free the arena that contains the cert. */
+	PORT_FreeArena(arena, PR_FALSE);
+	if (slot && freeSlot) {
+	    PK11_FreeSlot(slot);
+	}
     }
+    nss_ZFreeIf(dc);
     return PR_SUCCESS;
 }