Fix numerous bugs in CERT_FindCertByKeyID. Bug 233019. r=jpierre

1 files changed, 18 insertions, 8 deletions

diff --git a/security/nss/lib/certdb/stanpcertdb.c b/security/nss/lib/certdb/stanpcertdb.c
index a908c0f6d..c1420ad73 100644
--- a/security/nss/lib/certdb/stanpcertdb.c
+++ b/security/nss/lib/certdb/stanpcertdb.c
@@ -412,18 +412,28 @@ CERT_FindCertByName(CERTCertDBHandle *handle, SECItem *name)
 CERTCertificate *
 CERT_FindCertByKeyID(CERTCertDBHandle *handle, SECItem *name, SECItem *keyID)
 {
-   CERTCertList *list =
-                        CERT_CreateSubjectCertList(NULL,handle,name,0,PR_FALSE);
+    CERTCertList *list;
     CERTCertificate *cert = NULL;
-    CERTCertListNode *node = CERT_LIST_HEAD(list);
+    CERTCertListNode *node, *head;
 
+    list = CERT_CreateSubjectCertList(NULL,handle,name,0,PR_FALSE);
     if (list == NULL) return NULL;
 
-    for (node = CERT_LIST_HEAD(list); node ; node = CERT_LIST_NEXT(node)) {
-        if (SECITEM_ItemsAreEqual(&cert->subjectKeyID, keyID) ) {
-            cert = CERT_DupCertificate(node->cert);
-            break;
-        }
+    node = head = CERT_LIST_HEAD(list);
+    if (head) {
+	do {
+	    if (node->cert && 
+		SECITEM_ItemsAreEqual(&node->cert->subjectKeyID, keyID) ) {
+		cert = CERT_DupCertificate(node->cert);
+		goto done;
+	    }
+	    node = CERT_LIST_NEXT(node);
+	} while (node && head != node);
+    }
+    PORT_SetError(SEC_ERROR_UNKNOWN_ISSUER);
+done:
+    if (list) {
+        CERT_DestroyCertList(list);
     }
     return cert;
 }