+++ This bug was initially created as a clone of Bug #676083 +++

This was actually reported by Bob Relyea verbally, and I have confirmed the bug:

in JSS, there are places where PK11_GetInternalSlot() is called but never freed.
The most obvious ones are the ones that are called and used directly for comparison and not assigned to any variable (hence unfreeable).

The right way to do this is something like this:
PK11SlotInfo *aSlot = NULL;
...
...

aSlot = PK11_GetInternalSlot();
...
...

finish:
if (aSlot != NULL) {
    PK11_FreeSlot(aSlot);
}

What you don't want to do is something like this:
  if (slot != PK11_GetInternalSlot()) ...

if not fixed, other than memory leak, there are potential consequences such as
NSS may not be able to release the slot due to some internal counters.
Bob might be able to fill in on the detail.

--- Additional comment from rrelyea on 2011-02-08 14:31:58 EST ---

Most of the usages can be replaced by NSS functions that give better answers:

PK11_IsInternalKeySlot(slot) returns true if the slot is the default internal key slot.

PK11_IsInternal(slot) return true if the slot is any type of internal slot. Several of your checks should probably use this test as there can be more than one database slot these days.

The code I noticed this in is CryptoManager.c

bob