diff --git a/security/nss/lib/pkcs7/p7decode.c b/security/nss/lib/pkcs7/p7decode.c
index 641d201e5..a6a98960f 100644
--- a/security/nss/lib/pkcs7/p7decode.c
+++ b/security/nss/lib/pkcs7/p7decode.c
@@ -542,6 +542,7 @@ sec_pkcs7_decoder_start_decrypt(SEC_PKCS7DecoderContext *p7dcx, int depth,
      * We are done with (this) bulkkey now.
      */
     PK11_FreeSymKey(bulkkey);
+    bulkkey = NULL;
 
     if (decryptobj == NULL) {
         p7dcx->error = PORT_GetError();