diff --git a/mozilla/security/nss/lib/certhigh/certvfypkix.c b/mozilla/security/nss/lib/certhigh/certvfypkix.c
index 891101431fa..7c267faa4b0 100644
--- a/mozilla/security/nss/lib/certhigh/certvfypkix.c
+++ b/mozilla/security/nss/lib/certhigh/certvfypkix.c
@@ -1373,9 +1373,15 @@ PKIX_List *cert_PKIXMakeOIDList(const SECOidTag *oids, int oidCount, void *plCon
     if (error == NULL) r = policyList;
 
 cleanup:
+    if (policyOID != NULL)  {
+        PKIX_PL_Object_DecRef((PKIX_PL_Object *)policyOID, plContext);
+    }
     if (policyList != NULL)  {
         PKIX_PL_Object_DecRef((PKIX_PL_Object *)policyList, plContext);
     }
+    if (error != NULL)  {
+        PKIX_PL_Object_DecRef((PKIX_PL_Object *)error, plContext);
+    }
 
     return r;
 }
@@ -1704,6 +1710,9 @@ SECStatus CERT_PKIXVerifyCert(
     r = SECSuccess;
 
 cleanup:
+    if (anchors != NULL) 
+       PKIX_PL_Object_DecRef((PKIX_PL_Object *)anchors, plContext);
+
     if (procParams != NULL) 
        PKIX_PL_Object_DecRef((PKIX_PL_Object *)procParams, plContext);
 
@@ -1725,6 +1734,9 @@ cleanup:
     if (certSelector != NULL) 
        PKIX_PL_Object_DecRef((PKIX_PL_Object *)certSelector, plContext);
 
+    if (error != NULL) 
+       PKIX_PL_Object_DecRef((PKIX_PL_Object *)error, plContext);
+
     PKIX_PL_NssContext_Destroy(plContext);
 
     return r;
diff --git a/mozilla/security/nss/lib/libpkix/pkix_pl_nss/pki/pkix_pl_ocsprequest.c b/mozilla/security/nss/lib/libpkix/pkix_pl_nss/pki/pkix_pl_ocsprequest.c
index e675ff4d066..438d364fe5e 100644
--- a/mozilla/security/nss/lib/libpkix/pkix_pl_nss/pki/pkix_pl_ocsprequest.c
+++ b/mozilla/security/nss/lib/libpkix/pkix_pl_nss/pki/pkix_pl_ocsprequest.c
@@ -348,6 +348,9 @@ pkix_pl_OcspRequest_Create(
         ocspRequest->decoded = NULL;
         ocspRequest->encoded = NULL;
 
+        ocspRequest->certList = NULL;
+        ocspRequest->location = NULL;
+
         nssCert = cert->nssCert;
 
         /*