Bug 1720225 Coverity/cpp scanner errors found in nss 3.67

A number of coverity/scanner issues were found in the kdf code which was added in nss 3.44 and the fixes never upstreamed, as well as coverity/scanner errors in nss 3.66. Not all errors were fixed, those errors which were determined to be false positives were just recorded. No attempt has been made to fix coverity/scanner errors in gtests.

Differential Revision: https://phabricator.services.mozilla.com/D119829

5 files changed, 14 insertions, 6 deletions

diff --git a/lib/pk11wrap/pk11cxt.c b/lib/pk11wrap/pk11cxt.c
index d94d6fc68..0f170c352 100644
--- a/lib/pk11wrap/pk11cxt.c
+++ b/lib/pk11wrap/pk11cxt.c
@@ -382,7 +382,7 @@ pk11_CreateNewContextInSlot(CK_MECHANISM_TYPE type,
      * of the connection.*/
     context->fortezzaHack = PR_FALSE;
     if (type == CKM_SKIPJACK_CBC64) {
-        if (symKey->origin == PK11_OriginFortezzaHack) {
+        if (symKey && (symKey->origin == PK11_OriginFortezzaHack)) {
             context->fortezzaHack = PR_TRUE;
         }
     }
diff --git a/lib/pk11wrap/pk11hpke.c b/lib/pk11wrap/pk11hpke.c
index d867e1b6a..7c4bfc3cd 100644
--- a/lib/pk11wrap/pk11hpke.c
+++ b/lib/pk11wrap/pk11hpke.c
@@ -1164,8 +1164,6 @@ PK11_HPKE_Seal(HpkeContext *cx, const SECItem *aad, const SECItem *pt,
     unsigned char tagBuf[HASH_LENGTH_MAX];
     size_t tagLen;
     unsigned int fixedBits;
-    PORT_Assert(cx->baseNonce->len == sizeof(ivOut));
-    PORT_Memcpy(ivOut, cx->baseNonce->data, cx->baseNonce->len);
 
     /* aad may be NULL, PT may be zero-length but not NULL. */
     if (!cx || !cx->aeadContext ||
@@ -1176,6 +1174,9 @@ PK11_HPKE_Seal(HpkeContext *cx, const SECItem *aad, const SECItem *pt,
         return SECFailure;
     }
 
+    PORT_Assert(cx->baseNonce->len == sizeof(ivOut));
+    PORT_Memcpy(ivOut, cx->baseNonce->data, cx->baseNonce->len);
+
     tagLen = cx->aeadParams->tagLen;
     maxOut = pt->len + tagLen;
     fixedBits = (cx->baseNonce->len - 8) * 8;
diff --git a/lib/softoken/kbkdf.c b/lib/softoken/kbkdf.c
index b4544c432..57cce7017 100644
--- a/lib/softoken/kbkdf.c
+++ b/lib/softoken/kbkdf.c
@@ -613,6 +613,10 @@ kbkdf_CreateKey(CK_MECHANISM_TYPE kdf_mech, CK_SESSION_HANDLE hSession, CK_DERIV
     PR_ASSERT(derived_key != NULL);
     PR_ASSERT(derived_key->phKey != NULL);
 
+    if (slot == NULL) {
+        return CKR_SESSION_HANDLE_INVALID;
+    }
+
     /* Create the new key object for this additional derived key. */
     key = sftk_NewObject(slot);
     if (key == NULL) {
@@ -678,7 +682,9 @@ done:
     sftk_FreeObject(key);
 
     /* Doesn't do anything. */
-    sftk_FreeSession(session);
+    if (session) {
+        sftk_FreeSession(session);
+    }
 
     return ret;
 }
diff --git a/lib/softoken/sftkhmac.c b/lib/softoken/sftkhmac.c
index 1b38b06f9..bec2df79f 100644
--- a/lib/softoken/sftkhmac.c
+++ b/lib/softoken/sftkhmac.c
@@ -234,7 +234,9 @@ sftk_MAC_Init(sftk_MACCtx *ctx, CK_MECHANISM_TYPE mech, SFTKObject *key)
                            keyval->attrib.ulValueLen, isFIPS);
 
 done:
-    sftk_FreeAttribute(keyval);
+    if (keyval) {
+        sftk_FreeAttribute(keyval);
+    }
     return ret;
 }
 
diff --git a/lib/softoken/sftkike.c b/lib/softoken/sftkike.c
index 2183add69..6756040b6 100644
--- a/lib/softoken/sftkike.c
+++ b/lib/softoken/sftkike.c
@@ -1411,7 +1411,6 @@ sftk_fips_IKE_PowerUpSelfTests(void)
         (outKeySize != sizeof(ike_known_sha256_prf_plus)) ||
         (PORT_Memcmp(outKeyData, ike_known_sha256_prf_plus,
                      sizeof(ike_known_sha256_prf_plus)) != 0)) {
-        PORT_ZFree(outKeyData, outKeySize);
         PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
         return SECFailure;
     }