diff options
| author | alexei.volkov.bugs%sun.com <devnull@localhost> | 2006-05-13 00:41:25 +0000 |
|---|---|---|
| committer | alexei.volkov.bugs%sun.com <devnull@localhost> | 2006-05-13 00:41:25 +0000 |
| commit | 7fbfee2b90cc8b7235fb93db0e71ed48d879ac54 (patch) | |
| tree | acc61d66bf3e3b718643f208d349bd14bae476fb | |
| parent | 983991028a624d0b32ed8dca6c14d30020016b3a (diff) | |
| download | nss-hg-7fbfee2b90cc8b7235fb93db0e71ed48d879ac54.tar.gz | |
Patch contributed by timeless@bemail.org
[Bug 336972] OOM crash [@ PK11_ImportDERPrivateKeyInfoAndReturnKey] "pki" Pointer allocated by PORT_NewArena dereferenced without NULL check. r=nelson
| -rw-r--r-- | security/nss/lib/pk11wrap/pk11pk12.c | 12 |
1 files changed, 8 insertions, 4 deletions
diff --git a/security/nss/lib/pk11wrap/pk11pk12.c b/security/nss/lib/pk11wrap/pk11pk12.c index 35a4cbc07..9c8afdf4e 100644 --- a/security/nss/lib/pk11wrap/pk11pk12.c +++ b/security/nss/lib/pk11wrap/pk11pk12.c @@ -250,7 +250,13 @@ PK11_ImportDERPrivateKeyInfoAndReturnKey(PK11SlotInfo *slot, SECItem *derPKI, SECStatus rv = SECFailure; temparena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE); + if (!temparena) + return rv; pki = PORT_ArenaZNew(temparena, SECKEYPrivateKeyInfo); + if (!pki) { + PORT_FreeArena(temparena, PR_FALSE); + return rv; + } pki->arena = temparena; rv = SEC_ASN1DecodeItem(pki->arena, pki, SECKEY_PrivateKeyInfoTemplate, @@ -263,10 +269,8 @@ PK11_ImportDERPrivateKeyInfoAndReturnKey(PK11SlotInfo *slot, SECItem *derPKI, publicValue, isPerm, isPrivate, keyUsage, privk, wincx); finish: - if( pki != NULL ) { - /* this zeroes the key and frees the arena */ - SECKEY_DestroyPrivateKeyInfo(pki, PR_TRUE /*freeit*/); - } + /* this zeroes the key and frees the arena */ + SECKEY_DestroyPrivateKeyInfo(pki, PR_TRUE /*freeit*/); return rv; } |