Detect duplicate issuer name and serial number between two temp certs.

Bug 230996. r=ian, relyea.

1 files changed, 7 insertions, 5 deletions

diff --git a/security/nss/lib/certdb/stanpcertdb.c b/security/nss/lib/certdb/stanpcertdb.c
index 7d607e255..a908c0f6d 100644
--- a/security/nss/lib/certdb/stanpcertdb.c
+++ b/security/nss/lib/certdb/stanpcertdb.c
@@ -236,19 +236,21 @@ __CERT_NewTempCertificate(CERTCertDBHandle *handle, SECItem *derCert,
 	    /* Then, see if it is already a perm cert */
 	    c = NSSTrustDomain_FindCertificateByEncodedCertificate(handle, 
 	                                                           &encoding);
+	}
+	if (c) {
 	    /* actually, that search ends up going by issuer/serial,
 	     * so it is still possible to return a cert with the same
 	     * issuer/serial but a different encoding, and we're
 	     * going to reject that
 	     */
-	    if (c && !nssItem_Equal(&c->encoding, &encoding, NULL)) {
+	    if (!nssItem_Equal(&c->encoding, &encoding, NULL)) {
 		nssCertificate_Destroy(c);
 		PORT_SetError(SEC_ERROR_REUSED_ISSUER_AND_SERIAL);
-		return NULL;
+		cc = NULL;
+	    } else {
+		cc = STAN_GetCERTCertificate(c);
 	    }
-	}
-	if (c) {
-	    return STAN_GetCERTCertificate(c);
+	    return cc;
 	}
     }
     pkio = nssPKIObject_Create(NULL, NULL, gTD, gCC);