Fix an SECItem leak in the new ECSignatureCreator class.

crypto/ec_signature_creator_nss.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "crypto/ec_signature_creator.h"
 
 #include <cryptohi.h>
 #include <pk11pub.h>
 #include <secerr.h>
 #include <sechash.h>
@@ skipping 75 matching lines @@
   // Sign the secret data and save it to |result|.
   SECStatus rv =
       SignData(arena.get(), result, &secret, key_->key(), HASH_AlgSHA1);
   if (rv != SECSuccess) {
     DLOG(ERROR) << "DerSignData: " << PORT_GetError();
     return false;
   }
 
   // Copy the signed data into the output vector.
   signature->assign(result->data, result->data + result->len);
+  SECITEM_FreeItem(result, PR_FALSE);

[agl, 2012/01/31 15:40:55]

Thanks for catching this, but there's an underlying error here that should be
cleaned up.

|arena| is created and passed to |SignData|, but |SignData| doesn't use it, nor
can it. So |arena| should be removed, the first argument to SECITEM_AllocItem
should be "NULL /* no arena */". Lastly, the first argument to SignData should
be removed and then this line should be:

SECITEM_FreeItem(result, PR_TRUE /* also free |result| itself */);

[Ryan Hamilton, 2012/01/31 16:37:16]

No kidding?  Thanks for catching this.  As per wtc's suggestion, I used
x509_util_nss.cc 's SignCertificate method as the basis for this implementation.
 When it invokes SignData, should it also not being using the arena?

   return true;
 }
 
 }  // namespace crypto