Stop leaking NSS library objects in SecureSocket.

runtime/bin/secure_socket.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "bin/secure_socket.h"
 
 #include <errno.h>
 #include <fcntl.h>
 #include <sys/stat.h>
 #include <stdio.h>
 #include <string.h>
 
+#include <key.h>
+#include <keyt.h>
 #include <nss.h>
 #include <pk11pub.h>
 #include <prerror.h>
 #include <prinit.h>
 #include <prnetdb.h>
 #include <ssl.h>
 #include <sslproto.h>
 
 #include "bin/builtin.h"
 #include "bin/dartutils.h"
@@ skipping 274 matching lines @@
   }
 }
 
 
 void SSLFilter::RegisterHandshakeCompleteCallback(Dart_Handle complete) {
   ASSERT(NULL == handshake_complete_);
   handshake_complete_ = ThrowIfError(Dart_NewPersistentHandle(complete));
 }
 
 
-void SSLFilter::RegisterBadCertificateCallback(Dart_Handle complete) {
+void SSLFilter::RegisterBadCertificateCallback(Dart_Handle callback) {
   if (NULL != bad_certificate_callback_) {
     Dart_DeletePersistentHandle(bad_certificate_callback_);
   }
-  bad_certificate_callback_ = ThrowIfError(Dart_NewPersistentHandle(complete));
+  bad_certificate_callback_ = ThrowIfError(Dart_NewPersistentHandle(callback));
 }
 
 
 void SSLFilter::InitializeLibrary(const char* certificate_database,
                                   const char* password,
                                   bool use_builtin_root_certificates) {
   MutexLocker locker(&mutex_);
   if (!library_initialized_) {
     library_initialized_ = true;
     password_ = strdup(password);  // This one copy persists until Dart exits.
@@ skipping 63 matching lines @@
   if (status != SECSuccess) {
     ThrowPRException("Cannot get validity times from certificate");
   }
   int64_t start_epoch_ms = start_validity / PR_USEC_PER_MSEC;
   int64_t end_epoch_ms = end_validity / PR_USEC_PER_MSEC;
   bool accept = CallBadCertificateCallback(bad_certificate_callback_,
                                            certificate->subjectName,
                                            certificate->issuerName,
                                            start_epoch_ms,
                                            end_epoch_ms);
+  CERT_DestroyCertificate(certificate);
   return accept ? SECSuccess : SECFailure;
 }
 
 
 void SSLFilter::Connect(const char* host_name,
                         int port,
                         bool is_server,
                         const char* certificate_name) {
   is_server_ = is_server;
   if (in_handshake_) {
@@ skipping 15 matching lines @@
     CERTCertificate* certificate = CERT_FindCertByNameString(
         certificate_database,
         const_cast<char*>(certificate_name));
     if (certificate == NULL) {
       ThrowPRException("Cannot find server certificate by name");
     }
     SECKEYPrivateKey* key = PK11_FindKeyByAnyCert(
         certificate,
         static_cast<void*>(const_cast<char*>(password_)));
     if (key == NULL) {
+      CERT_DestroyCertificate(certificate);
       if (PR_GetError() == -8177) {
         ThrowPRException("Certificate database password incorrect");
       } else {
         ThrowPRException("Unsuccessful PK11_FindKeyByAnyCert call."
                          " Cannot find private key for certificate");
       }
     }
     // kt_rsa (key type RSA) is an enum constant from the NSS libraries.
     // TODO(whesse): Allow different key types.
     status = SSL_ConfigSecureServer(filter_, certificate, key, kt_rsa);
+    CERT_DestroyCertificate(certificate);
+    SECKEY_DestroyPrivateKey(key);
     if (status != SECSuccess) {
       ThrowPRException("Unsuccessful SSL_ConfigSecureServer call");
     }
   } else {  // Client.
     if (SSL_SetURL(filter_, host_name) == -1) {
       ThrowPRException("Unsuccessful SetURL call");
     }
   }
 
   // Install bad certificate callback, and pass 'this' to it if it is called.
@@ skipping 53 matching lines @@
   for (int i = 0; i < kNumBuffers; ++i) {
     Dart_DeletePersistentHandle(dart_buffer_objects_[i]);
     delete[] buffers_[i];
   }
   Dart_DeletePersistentHandle(string_start_);
   Dart_DeletePersistentHandle(string_length_);
   Dart_DeletePersistentHandle(handshake_complete_);
   if (bad_certificate_callback_ != NULL) {
     Dart_DeletePersistentHandle(bad_certificate_callback_);
   }
-  // TODO(whesse): Free NSS objects here.
+
+  PR_Close(filter_);
 }
 
 
 intptr_t SSLFilter::ProcessBuffer(int buffer_index) {
   Dart_Handle buffer_object = dart_buffer_objects_[buffer_index];
   Dart_Handle start_object = ThrowIfError(
       Dart_GetField(buffer_object, string_start_));
   Dart_Handle length_object = ThrowIfError(
       Dart_GetField(buffer_object, string_length_));
   int64_t unsafe_start = DartUtils::GetIntegerValue(start_object);
@@ skipping 81 matching lines @@
         if (PR_WOULD_BLOCK_ERROR != pr_error) {
           ThrowPRException("Error reading plaintext from SSLFilter");
         }
         bytes_processed = 0;
       }
       break;
     }
   }
   return bytes_processed;
 }