nss_ZFreeIf(subjectCerts);
find_issuer_cert_for_identifier(NSSCertificate *c, NSSItem *id){    NSSCertificate *rvCert = NULL;    NSSCertificate **subjectCerts = NULL;    NSSTrustDomain *td;    NSSCryptoContext *cc;    /* Find all certs with this cert's issuer as the subject */    cc = c->object.cryptoContext; /* NSSCertificate_GetCryptoContext(c); */    if (cc) {	subjectCerts = NSSCryptoContext_FindCertificatesBySubject(cc,	                                                          &c->issuer,	                                                          NULL,	                                                          0,	                                                          NULL);    }    if (!subjectCerts) {	/* The general behavior of NSS <3.4 seems to be that if the search	 * turns up empty in the temp db, fall back to the perm db,	 * irregardless of whether or not the cert itself is perm or temp.	 * This is replicated here.	 */	td = NSSCertificate_GetTrustDomain(c);	subjectCerts = NSSTrustDomain_FindCertificatesBySubject(td,	                                                        &c->issuer,	                                                        NULL,	                                                        0,	                                                        NULL);    }    if (subjectCerts) {	NSSCertificate *p;	nssDecodedCert *dcp;	int i = 0;	/* walk the subject certs */	while ((p = subjectCerts[i++])) {	    dcp = nssCertificate_GetDecoding(p);	    if (dcp->matchIdentifier(dcp, id)) {		/* this cert has the correct identifier */		rvCert = p;		/* now free all the remaining subject certs */		while ((p = subjectCerts[i++])) {		    NSSCertificate_Destroy(p);		}		/* and exit */		break;	    } else {		/* cert didn't have the correct identifier, so free it */		NSSCertificate_Destroy(p);	    }	}	nss_ZFreeIf(subjectCerts);    }    return rvCert;}