From f95bd2e5bc739e39dedf1f5eba0f65d0aaa27d5f Mon Sep 17 00:00:00 2001 From: Kamil Dudka Date: Tue, 6 Sep 2011 18:17:38 +0200 Subject: [PATCH 4/4] nss: avoid a SIGSEGV with immature version of NSS Bug: https://bugzilla.redhat.com/733685 --- lib/nss.c | 24 +++++++++++++++++++++++- 1 files changed, 23 insertions(+), 1 deletions(-) diff --git a/lib/nss.c b/lib/nss.c index 5746e01..7a45e2b 100644 --- a/lib/nss.c +++ b/lib/nss.c @@ -381,7 +381,29 @@ static CURLcode nss_load_cert(struct ssl_connect_data *ssl, #ifdef HAVE_PK11_CREATEGENERICOBJECT /* libnsspem.so leaks memory if the requested file does not exist */ if(is_file(filename)) - return nss_create_object(ssl, CKO_CERTIFICATE, filename, cacert); + err = nss_create_object(ssl, CKO_CERTIFICATE, filename, cacert); + + if(CURLE_OK == err && !cacert) { + /* we have successfully loaded a client certificate */ + CERTCertificate *cert; + char *nickname = NULL; + char *n = strrchr(filename, '/'); + if(n) + n++; + + /* The following undocumented magic helps to avoid a SIGSEGV on call + * of PK11_ReadRawAttribute() from SelectClientCert() when using For + * an immature version of libnsspem.so. For more details, go to + * . */ + nickname = aprintf("PEM Token #1:%s", n); + if(nickname) { + cert = PK11_FindCertFromNickname(nickname, NULL); + if(cert) + CERT_DestroyCertificate(cert); + + free(nickname); + } + } #endif return err; -- 1.7.4.4