From 8ebf848c0a24bf1171db823c9056e32fbff2438c Mon Sep 17 00:00:00 2001 From: "alexei.volkov.bugs%sun.com" Date: Mon, 12 Jun 2006 21:16:57 +0000 Subject: [PATCH] [Bug 337099] Crash [@ PK11_ParamFromIV] Variable "iv" tracked as NULL was dereferenced. r=nelson git-svn-id: svn://10.0.0.236/trunk@199756 18797224-902f-48f8-a5cc-f745e15eee43 --- mozilla/security/nss/lib/pk11wrap/pk11mech.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/mozilla/security/nss/lib/pk11wrap/pk11mech.c b/mozilla/security/nss/lib/pk11wrap/pk11mech.c index 1f8f2a372e9..fe106de5053 100644 --- a/mozilla/security/nss/lib/pk11wrap/pk11mech.c +++ b/mozilla/security/nss/lib/pk11wrap/pk11mech.c @@ -823,7 +823,7 @@ PK11_ParamFromIV(CK_MECHANISM_TYPE type,SECItem *iv) rc5_cbc_params = (CK_RC5_CBC_PARAMS *) PORT_Alloc(sizeof(CK_RC5_CBC_PARAMS) + ((iv) ? iv->len : 0)); if (rc5_cbc_params == NULL) break; - if (iv && iv->data) { + if (iv && iv->data && iv->len) { rc5_cbc_params->pIv = ((CK_BYTE_PTR) rc5_cbc_params) + sizeof(CK_RC5_CBC_PARAMS); PORT_Memcpy(rc5_cbc_params->pIv,iv->data,iv->len); @@ -832,7 +832,7 @@ PK11_ParamFromIV(CK_MECHANISM_TYPE type,SECItem *iv) } else { rc5_cbc_params->ulWordsize = 4; rc5_cbc_params->pIv = NULL; - rc5_cbc_params->ulIvLen = iv->len; + rc5_cbc_params->ulIvLen = 0; } rc5_cbc_params->ulRounds = 16; param->data = (unsigned char *) rc5_cbc_params;