This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat-native.git
The following commit(s) were added to refs/heads/main by this push:
new edc04adf9 Make the processing of OCSP responses more robust
edc04adf9 is described below
commit edc04adf9a384b2a89d92d0a5b1787edc1f3ace7
Author: Mark Thomas <[email protected]>
AuthorDate: Fri Aug 28 18:11:00 2026 +0100
Make the processing of OCSP responses more robust
---
native/src/sslutils.c | 4 ++++
xdocs/miscellaneous/changelog.xml | 3 +++
2 files changed, 7 insertions(+)
diff --git a/native/src/sslutils.c b/native/src/sslutils.c
index d22d4cd41..f625f5998 100644
--- a/native/src/sslutils.c
+++ b/native/src/sslutils.c
@@ -1029,6 +1029,10 @@ static int process_ocsp_response(OCSP_REQUEST *ocsp_req,
OCSP_RESPONSE *ocsp_res
}
bs = OCSP_response_get1_basic(ocsp_resp);
+ if (bs == NULL) {
+ X509_STORE_CTX_set_error(ctx, X509_V_ERR_OCSP_RESP_INVALID);
+ return OCSP_STATUS_UNKNOWN;
+ }
if (OCSP_check_nonce(ocsp_req, bs) == 0) {
X509_STORE_CTX_set_error(ctx, X509_V_ERR_OCSP_RESP_INVALID);
o = OCSP_STATUS_UNKNOWN;
diff --git a/xdocs/miscellaneous/changelog.xml
b/xdocs/miscellaneous/changelog.xml
index fdb3906b7..3c9472f34 100644
--- a/xdocs/miscellaneous/changelog.xml
+++ b/xdocs/miscellaneous/changelog.xml
@@ -81,6 +81,9 @@
<fix>
Avoid a potential crash when processing OCSP URLs. (markt)
</fix>
+ <fix>
+ Make the processing of OCSP responses more robust. (markt)
+ </fix>
</changelog>
</section>
<section name="2.0.15" rtext="2026-06-15">
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
