1 files changed, 7 insertions, 3 deletions
diff --git a/src/share/classes/sun/security/pkcs11/P11SecretKeyFactory.java b/src/share/classes/sun/security/pkcs11/P11SecretKeyFactory.java
index f4306b3a9a..e6ed887419 100644
--- a/src/share/classes/sun/security/pkcs11/P11SecretKeyFactory.java
+++ b/src/share/classes/sun/security/pkcs11/P11SecretKeyFactory.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2003, 2011, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2003, 2018, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -146,20 +146,24 @@ final class P11SecretKeyFactory extends SecretKeyFactorySpi {
             P11Key p11Key = (P11Key)key;
             if (p11Key.token == token) {
                 if (extraAttrs != null) {
+                    P11Key newP11Key = null;
                     Session session = null;
+                    long p11KeyID = p11Key.getKeyID();
                     try {
                         session = token.getObjSession();
                         long newKeyID = token.p11.C_CopyObject(session.id(),
-                                p11Key.keyID, extraAttrs);
-                        p11Key = (P11Key) (P11Key.secretKey(session,
+                            p11KeyID, extraAttrs);
+                        newP11Key = (P11Key) (P11Key.secretKey(session,
                                 newKeyID, p11Key.algorithm, p11Key.keyLength,
                                 extraAttrs));
                     } catch (PKCS11Exception p11e) {
                         throw new InvalidKeyException
                                 ("Cannot duplicate the PKCS11 key", p11e);
                     } finally {
+                        p11Key.releaseKeyID();
                         token.releaseSession(session);
                     }
+                    p11Key = newP11Key;
                 }
                 return p11Key;
             }