Security-58286.260.20.tar.gz

[apple/security.git] / OSX / libsecurity_asn1 / lib / secasn1d.c

diff --git a/OSX/libsecurity_asn1/lib/secasn1d.c b/OSX/libsecurity_asn1/lib/secasn1d.c
index 456309ab44af281365366271485f94b32a4749d1..cd37fc4abc83adaf95c7cac36f235081ae3f547e 100644 (file)
--- a/OSX/libsecurity_asn1/lib/secasn1d.c
+++ b/OSX/libsecurity_asn1/lib/secasn1d.c
@@ -389,7 +389,7 @@ sec_asn1d_push_state (SEC_ASN1DecoderContext *cx,
                      const SecAsn1Template *theTemplate,
                      void *dest, PRBool new_depth)
 {
                      const SecAsn1Template *theTemplate,
                      void *dest, PRBool new_depth)
 {

-    sec_asn1d_state *state, *new_state;
+    sec_asn1d_state *state, *new_state = NULL;

 
     state = cx->current;
 
 
     state = cx->current;
 


@@ -434,6 +434,9 @@ loser:
         PORT_ArenaRelease(cx->our_pool, state->our_mark);
         state->our_mark = NULL;
     }
         PORT_ArenaRelease(cx->our_pool, state->our_mark);
         state->our_mark = NULL;
     }

+    if (new_state != NULL) {
+        PORT_Free(new_state);
+    }

     return NULL;
 }
 
     return NULL;
 }
 


@@ -1069,7 +1072,9 @@ sec_asn1d_check_and_subtract_length (unsigned long *remaining,
     PORT_Assert(cx);
     if (!remaining || !cx) {
         PORT_SetError (SEC_ERROR_INVALID_ARGS);
     PORT_Assert(cx);
     if (!remaining || !cx) {
         PORT_SetError (SEC_ERROR_INVALID_ARGS);

-        cx->status = decodeError;
+        if(cx) {
+            cx->status = decodeError;
+        }

         return PR_FALSE;
     }
     if (*remaining < consumed) {
         return PR_FALSE;
     }
     if (*remaining < consumed) {


@@ -1429,8 +1434,10 @@ regular_string_type:
                    alloc_len += subitem->len;
            }
 
                    alloc_len += subitem->len;
            }
 

-           item->Data = (unsigned char*)sec_asn1d_zalloc (poolp, alloc_len);
-           if (item->Data == NULL) {
+        if (item) {
+            item->Data = (unsigned char*)sec_asn1d_zalloc (poolp, alloc_len);
+        }
+        if (item == NULL || item->Data == NULL) {

                    dprintf("decodeError: prepare for contents zalloc\n");
                        state->top->status = decodeError;
                        break;
                    dprintf("decodeError: prepare for contents zalloc\n");
                        state->top->status = decodeError;
                        break;