Ything-RepoMirrors/openssl
2
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2026-01-25 02:56:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

tls_process_cert_status_body(): Reject invalid cert status

Browse Source 
When a CertStatus message is received and the length of the
OCSP response is zero error out.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29207)

(cherry picked from commit ccd8451428)
This commit is contained in:
Ryan Hooper
2025-11-13 11:08:42 -05:00
committed by Tomas Mraz
parent 26d1f14114
commit a06612e1bf
1 changed files with 23 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

45
ssl/statem/statem_clnt.c
View File

@@ -2942,29 +2942,30 @@ int tls_process_cert_status_body(SSL_CONNECTION *s, size_t chainidx, PACKET *pkt
return 0;
}
if (resplen > 0) {
respder = OPENSSL_malloc(resplen);
if (respder == NULL) {
SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB);
return 0;
}
if (!PACKET_copy_bytes(pkt, respder, resplen)) {
SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
OPENSSL_free(respder);
return 0;
}
p = respder;
resp = d2i_OCSP_RESPONSE(NULL, &p, (long)resplen);
OPENSSL_free(respder);
if (resp == NULL) {
SSLfatal(s, TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE,
SSL_R_TLSV1_BAD_CERTIFICATE_STATUS_RESPONSE);
return 0;
}
sk_OCSP_RESPONSE_insert(s->ext.ocsp.resp_ex, resp, (int)chainidx);
if (resplen == 0) {
SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_PACKET);
return 0;
}
if ((respder = OPENSSL_malloc(resplen)) == NULL) {
SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB);
return 0;
}
if (!PACKET_copy_bytes(pkt, respder, resplen)) {
SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
OPENSSL_free(respder);
return 0;
}
p = respder;
resp = d2i_OCSP_RESPONSE(NULL, &p, (long)resplen);
OPENSSL_free(respder);
if (resp == NULL) {
SSLfatal(s, TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE,
SSL_R_TLSV1_BAD_CERTIFICATE_STATUS_RESPONSE);
return 0;
}
sk_OCSP_RESPONSE_insert(s->ext.ocsp.resp_ex, resp, (int)chainidx);
}
#endif