object->handle = pk11_mkHandle(slot,&derSubj,
(void) pk11_poisonHandle(slot, &derSubj, isKRL ? PK11_TOKEN_KRL_HANDLE : PK11_TOKEN_TYPE_CRL); object->handle = pk11_mkHandle(slot, &derSubj,
pk11_handleCrlObject(PK11Session *session,PK11Object *object){    /* we can't store any certs private */    if (pk11_isTrue(object,CKA_PRIVATE)) {	return CKR_ATTRIBUTE_VALUE_INVALID;    }    /* certificates must have a type */    if ( !pk11_hasAttribute(object,CKA_SUBJECT) ) {	return CKR_TEMPLATE_INCOMPLETE;    }    if ( !pk11_hasAttribute(object,CKA_VALUE) ) {	return CKR_TEMPLATE_INCOMPLETE;    }    if (pk11_isTrue(object,CKA_TOKEN)) {	PK11Slot *slot = session->slot;	PRBool isKRL = PR_FALSE;	SECItem derSubj,derCrl;	char *url = NULL;    	PK11Attribute *subject,*crl;	SECStatus rv;	PORT_Assert(slot);	if (slot->certDB == NULL) {	    return CKR_TOKEN_WRITE_PROTECTED;	}	/* lookup SUBJECT */	subject = pk11_FindAttribute(object,CKA_SUBJECT);	PORT_Assert(subject);	derSubj.data = (unsigned char *)subject->attrib.pValue;	derSubj.len = subject->attrib.ulValueLen ;	/* lookup VALUE */	crl = pk11_FindAttribute(object,CKA_VALUE);	PORT_Assert(crl);	derCrl.data = (unsigned char *)crl->attrib.pValue;	derCrl.len = crl->attrib.ulValueLen ;	url = pk11_getString(object,CKA_NETSCAPE_URL);	isKRL = pk11_isTrue(object,CKA_NETSCAPE_KRL);	/* Store CRL by SUBJECT */	rv = nsslowcert_AddCrl(slot->certDB, &derCrl, &derSubj, url, isKRL);	if (url) {	    PORT_Free(url);	}    	pk11_FreeAttribute(crl);	if (rv != SECSuccess) {    	    pk11_FreeAttribute(subject);	    return CKR_DEVICE_ERROR;	}	object->handle = pk11_mkHandle(slot,&derSubj,			isKRL ? PK11_TOKEN_KRL_HANDLE : PK11_TOKEN_TYPE_CRL);    	pk11_FreeAttribute(subject);    }    return CKR_OK;}