diff --git a/security/nss/lib/certdb/certdb.c b/security/nss/lib/certdb/certdb.c
index 0796fe5d75..80dccee125 100644
--- a/security/nss/lib/certdb/certdb.c
+++ b/security/nss/lib/certdb/certdb.c
@@ -384,9 +384,9 @@ GetKeyUsage(CERTCertificate *cert)
     rv = CERT_FindKeyUsageExtension(cert, &tmpitem);
     if (rv == SECSuccess) {
         /* remember the actual value of the extension */
-        cert->rawKeyUsage = tmpitem.data[0];
+        cert->rawKeyUsage = tmpitem.len ? tmpitem.data[0] : 0;
         cert->keyUsagePresent = PR_TRUE;
-        cert->keyUsage = tmpitem.data[0];
+        cert->keyUsage = cert->rawKeyUsage;
 
         PORT_Free(tmpitem.data);
         tmpitem.data = NULL;
@@ -506,7 +506,7 @@ cert_ComputeCertType(CERTCertificate *cert)
         isCA = basicConstraint.isCA;
     }
     if (tmpitem.data != NULL || extKeyUsage != NULL) {
-        if (tmpitem.data == NULL) {
+        if (tmpitem.data == NULL || tmpitem.len == 0) {
             nsCertType = 0;
         } else {
             nsCertType = tmpitem.data[0];
diff --git a/security/nss/lib/certdb/certv3.c b/security/nss/lib/certdb/certv3.c
index d27fc1ba0d..f00b88f1d7 100644
--- a/security/nss/lib/certdb/certv3.c
+++ b/security/nss/lib/certdb/certv3.c
@@ -213,7 +213,7 @@ CERT_CheckCertUsage(CERTCertificate *cert, unsigned char usage)
     if (rv == SECFailure) {
         rv = (PORT_GetError() == SEC_ERROR_EXTENSION_NOT_FOUND) ? SECSuccess
                                                                 : SECFailure;
-    } else if (!keyUsage.data || !(keyUsage.data[0] & usage)) {
+    } else if (!keyUsage.data || !keyUsage.len || !(keyUsage.data[0] & usage)) {
         PORT_SetError(SEC_ERROR_CERT_USAGES_INVALID);
         rv = SECFailure;
     }
diff --git a/security/nss/lib/certdb/certxutl.c b/security/nss/lib/certdb/certxutl.c
index c53f15cdff..eb1cb1485f 100644
--- a/security/nss/lib/certdb/certxutl.c
+++ b/security/nss/lib/certdb/certxutl.c
@@ -417,12 +417,14 @@ CERT_FindBitStringExtension(CERTCertExtension **extensions, int tag,
         goto loser;
     }
 
-    retItem->data = (unsigned char *)PORT_Alloc((tmpItem.len + 7) >> 3);
+    retItem->data = (unsigned char *)PORT_ZAlloc((tmpItem.len + 7) >> 3);
     if (retItem->data == NULL) {
         goto loser;
     }
 
-    PORT_Memcpy(retItem->data, tmpItem.data, (tmpItem.len + 7) >> 3);
+    if (tmpItem.len > 0) {
+        PORT_Memcpy(retItem->data, tmpItem.data, (tmpItem.len + 7) >> 3);
+    }
     retItem->len = tmpItem.len;
 
     rv = SECSuccess;