--- a/security/nss/lib/pk11wrap/pk11cert.c
+++ b/security/nss/lib/pk11wrap/pk11cert.c
@@ -2472,28 +2472,35 @@ PK11_ListCertsInSlot(PK11SlotInfo *slot)
     }
 
     return certs;
 }
 
 PK11SlotList *
 PK11_GetAllSlotsForCert(CERTCertificate *cert, void *arg)
 {
-    NSSCertificate *c = STAN_GetNSSCertificate(cert);
-    /* add multiple instances to the cert list */
     nssCryptokiObject **ip;
-    nssCryptokiObject **instances = nssPKIObject_GetInstances(&c->object);
     PK11SlotList *slotList;
+    NSSCertificate *c;
+    nssCryptokiObject **instances;
     PRBool found = PR_FALSE;
 
     if (!cert) {
 	PORT_SetError(SEC_ERROR_INVALID_ARGS);
 	return NULL;
     }
 
+    c = STAN_GetNSSCertificate(cert);
+    if (!c) {
+	CERT_MapStanError();
+	return NULL;
+    }
+
+    /* add multiple instances to the cert list */
+    instances = nssPKIObject_GetInstances(&c->object);
     if (!instances) {
 	PORT_SetError(SEC_ERROR_NO_TOKEN);
 	return NULL;
     }
 
     slotList = PK11_NewSlotList();
     if (!slotList) {
 	nssCryptokiObjectArray_Destroy(instances);

--- a/security/nss/lib/pk11wrap/pk11skey.c
+++ b/security/nss/lib/pk11wrap/pk11skey.c
@@ -1149,23 +1149,28 @@ PK11_PubWrapSymKey(CK_MECHANISM_TYPE typ
     CK_ULONG len =  wrappedKey->len;
     PK11SymKey *newKey = NULL;
     CK_OBJECT_HANDLE id;
     CK_MECHANISM mechanism;
     PRBool owner = PR_TRUE;
     CK_SESSION_HANDLE session;
     CK_RV crv;
 
+    if (symKey == NULL) {
+	PORT_SetError( SEC_ERROR_INVALID_ARGS );
+	return SECFailure;
+    }
+
     /* if this slot doesn't support the mechanism, go to a slot that does */
     newKey = pk11_ForceSlot(symKey,type,CKA_ENCRYPT);
     if (newKey != NULL) {
 	symKey = newKey;
     }
 
-    if ((symKey == NULL) || (symKey->slot == NULL)) {
+    if (symKey->slot == NULL) {
 	PORT_SetError( SEC_ERROR_NO_MODULE );
 	return SECFailure;
     }
 
     slot = symKey->slot;
     mechanism.mechanism = pk11_mapWrapKeyType(pubKey->keyType);
     mechanism.pParameter = NULL;
     mechanism.ulParameterLen = 0;