Bug 1370866 - Check return value of PK11Slot_GetNSSToken. r=djackson

Differential Revision: https://phabricator.services.mozilla.com/D139420

2 files changed, 8 insertions, 0 deletions

diff --git a/lib/certdb/crl.c b/lib/certdb/crl.c
index cc5c71f20..d11084124 100644
--- a/lib/certdb/crl.c
+++ b/lib/certdb/crl.c
@@ -1391,6 +1391,7 @@ TokenCRLStillExists(CERTSignedCrl* crl)
     arena = NSSArena_Create();
     PORT_Assert(arena);
     if (!arena) {
+        (void)nssToken_Destroy(instance.token);
         return PR_FALSE;
     }
 
@@ -1412,6 +1413,7 @@ TokenCRLStillExists(CERTSignedCrl* crl)
         xstatus = PR_FALSE;
     }
     NSSArena_Destroy(arena);
+    (void)nssToken_Destroy(instance.token);
     return xstatus;
 }
 
diff --git a/lib/certdb/stanpcertdb.c b/lib/certdb/stanpcertdb.c
index 8e1cf279a..e255df105 100644
--- a/lib/certdb/stanpcertdb.c
+++ b/lib/certdb/stanpcertdb.c
@@ -299,9 +299,15 @@ __CERT_AddTempCertToPerm(CERTCertificate *cert, char *nickname,
     /* Import the perm instance onto the internal token */
     slot = PK11_GetInternalKeySlot();
     internal = PK11Slot_GetNSSToken(slot);
+    if (!internal) {
+        PK11_FreeSlot(slot);
+        PORT_SetError(SEC_ERROR_NO_TOKEN);
+        return SECFailure;
+    }
     permInstance = nssToken_ImportCertificate(
         internal, NULL, NSSCertificateType_PKIX, &c->id, stanNick, &c->encoding,
         &c->issuer, &c->subject, &c->serial, cert->emailAddr, PR_TRUE);
+    (void)nssToken_Destroy(internal);
     nss_ZFreeIf(stanNick);
     stanNick = NULL;
     PK11_FreeSlot(slot);