bug 125263, the subject lists in the temp store are actual hash entries, thus any attempt to extract certs from them must be done within the store's lock.

1 files changed, 6 insertions, 14 deletions

diff --git a/security/nss/lib/pki/pkistore.c b/security/nss/lib/pki/pkistore.c
index 38b17ddad..f3d130ac9 100644
--- a/security/nss/lib/pki/pkistore.c
+++ b/security/nss/lib/pki/pkistore.c
@@ -348,11 +348,7 @@ nssCertificateStore_FindCertificatesBySubject
     PZ_Lock(store->lock);
     subjectList = (nssList *)nssHash_Lookup(store->subject, subject);
     if (subjectList) {
-	/* get references before leaving the store's lock protection */
 	nssCertificateList_AddReferences(subjectList);
-    }
-    PZ_Unlock(store->lock);
-    if (subjectList) {
 	count = nssList_Count(subjectList);
 	if (maximumOpt > 0) {
 	    count = PR_MIN(maximumOpt, count);
@@ -361,12 +357,12 @@ nssCertificateStore_FindCertificatesBySubject
 	    nssList_GetArray(subjectList, (void **)rvOpt, count);
 	} else {
 	    rvArray = nss_ZNEWARRAY(arenaOpt, NSSCertificate *, count + 1);
-	    if (!rvArray) {
-		return (NSSCertificate **)NULL;
+	    if (rvArray) {
+		nssList_GetArray(subjectList, (void **)rvArray, count);
 	    }
-	    nssList_GetArray(subjectList, (void **)rvArray, count);
 	}
     }
+    PZ_Unlock(store->lock);
     return rvArray;
 }
 
@@ -422,11 +418,7 @@ nssCertificateStore_FindCertificatesByNickname
     PZ_Lock(store->lock);
     nssHash_Iterate(store->subject, match_nickname, &nt);
     if (nt.subjectList) {
-	/* get references before leaving the store's lock protection */
 	nssCertificateList_AddReferences(nt.subjectList);
-    }
-    PZ_Unlock(store->lock);
-    if (nt.subjectList) {
 	count = nssList_Count(nt.subjectList);
 	if (maximumOpt > 0) {
 	    count = PR_MIN(maximumOpt, count);
@@ -435,12 +427,12 @@ nssCertificateStore_FindCertificatesByNickname
 	    nssList_GetArray(nt.subjectList, (void **)rvOpt, count);
 	} else {
 	    rvArray = nss_ZNEWARRAY(arenaOpt, NSSCertificate *, count + 1);
-	    if (!rvArray) {
-		return (NSSCertificate **)NULL;
+	    if (rvArray) {
+		nssList_GetArray(nt.subjectList, (void **)rvArray, count);
 	    }
-	    nssList_GetArray(nt.subjectList, (void **)rvArray, count);
 	}
     }
+    PZ_Unlock(store->lock);
     return rvArray;
 }