rv = cert_check_crl_entries(&crl->crl); if (rv != SECSuccess) { extended->badExtensions = PR_TRUE; }
SECStatus CERT_CompleteCRLDecodeEntries(CERTSignedCrl* crl){    SECStatus rv = SECSuccess;    SECItem* crldata = NULL;    OpaqueCRLFields* extended = NULL;    if ( (!crl) ||        (!(extended = (OpaqueCRLFields*) crl->opaque))  ) {        rv = SECFailure;    } else {        if (PR_FALSE == extended->partial) {            /* the CRL has already been fully decoded */            return SECSuccess;        }        if (PR_TRUE == extended->badEntries) {            /* the entries decoding already failed */            return SECFailure;        }        crldata = &crl->signatureWrap.data;        if (!crldata) {            rv = SECFailure;        }    }    if (SECSuccess == rv) {        rv = SEC_QuickDERDecodeItem(crl->arena,            &crl->crl,            CERT_CrlTemplateEntriesOnly,            crldata);        if (SECSuccess == rv) {            extended->partial = PR_FALSE; /* successful decode, avoid                decoding again */        } else {            extended->bad = PR_TRUE;            extended->badEntries = PR_TRUE;            /* cache the decoding failure. If it fails the first time,               it will fail again, which will grow the arena and leak               memory, so we want to avoid it */        }    }    return rv;}