Bug 1680400 - Fix memory leak in PK11_UnwrapPrivKey. r=bbeurdouche

Differential Revision: https://phabricator.services.mozilla.com/D98772 --HG-- extra : moz-landing-system : lando
sailfishos-mirror · Dec 4, 2020 · ba04100 · ba04100
1 parent d0ca572
commit ba04100
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 6 deletions.
diff --git a/gtests/pk11_gtest/pk11_aeskeywrappad_unittest.cc b/gtests/pk11_gtest/pk11_aeskeywrappad_unittest.cc
@@ -66,6 +66,14 @@ TEST_F(Pkcs11AESKeyWrapPadTest, WrapUnwrapECKey) {
                          true, CKK_EC, usages, usageCount, nullptr));
   ASSERT_EQ(0, PORT_GetError());
   ASSERT_TRUE(!!unwrapped);
+
+  // Try it with internal params allocation.
+  SECKEYPrivateKey* tmp = PK11_UnwrapPrivKey(
+      slot.get(), kek.get(), CKM_NSS_AES_KEY_WRAP_PAD, nullptr, wrapped.get(),
+      nullptr, &pubKey, false, true, CKK_EC, usages, usageCount, nullptr);
+  ASSERT_EQ(0, PORT_GetError());
+  ASSERT_NE(nullptr, tmp);
+  unwrapped.reset(tmp);
 }
 
 // Encrypt an ephemeral RSA key

diff --git a/lib/pk11wrap/pk11obj.c b/lib/pk11wrap/pk11obj.c
@@ -1321,23 +1321,23 @@ PK11_UnwrapPrivKey(PK11SlotInfo *slot, PK11SymKey *wrappingKey,
                                                                 NULL, perm, sensitive);
                 SECKEY_DestroyPrivateKey(privKey);
                 PK11_FreeSlot(int_slot);
+                SECITEM_FreeItem(param_free, PR_TRUE);
                 return newPrivKey;
             }
         }
         if (int_slot)
             PK11_FreeSlot(int_slot);
         PORT_SetError(PK11_MapError(crv));
+        SECITEM_FreeItem(param_free, PR_TRUE);
         return NULL;
     }
+    SECITEM_FreeItem(param_free, PR_TRUE);
     return PK11_MakePrivKey(slot, nullKey, PR_FALSE, privKeyID, wincx);
 
 loser:
-    if (newKey) {
-        PK11_FreeSymKey(newKey);
-    }
-    if (ck_id) {
-        SECITEM_FreeItem(ck_id, PR_TRUE);
-    }
+    PK11_FreeSymKey(newKey);
+    SECITEM_FreeItem(ck_id, PR_TRUE);
+    SECITEM_FreeItem(param_free, PR_TRUE);
     return NULL;
 }