This is an automated email from the ASF dual-hosted git repository. markt-asf pushed a commit to branch 1.3.x in repository https://gitbox.apache.org/repos/asf/tomcat-native.git
commit 5a3a81a37c53475e185a3ca9478a3c980be8f6a7 Author: Mark Thomas <[email protected]> AuthorDate: Fri Aug 28 18:11:00 2026 +0100 Make the processing of OCSP responses more robust --- native/src/sslutils.c | 4 ++++ xdocs/miscellaneous/changelog.xml | 3 +++ 2 files changed, 7 insertions(+) diff --git a/native/src/sslutils.c b/native/src/sslutils.c index b17638ffc..ddf87e59e 100644 --- a/native/src/sslutils.c +++ b/native/src/sslutils.c @@ -1096,6 +1096,10 @@ static int process_ocsp_response(OCSP_REQUEST *ocsp_req, OCSP_RESPONSE *ocsp_res } bs = OCSP_response_get1_basic(ocsp_resp); + if (bs == NULL) { + X509_STORE_CTX_set_error(ctx, X509_V_ERR_OCSP_RESP_INVALID); + return OCSP_STATUS_UNKNOWN; + } if (OCSP_check_nonce(ocsp_req, bs) == 0) { X509_STORE_CTX_set_error(ctx, X509_V_ERR_OCSP_RESP_INVALID); o = OCSP_STATUS_UNKNOWN; diff --git a/xdocs/miscellaneous/changelog.xml b/xdocs/miscellaneous/changelog.xml index 15735566e..b1ecedd78 100644 --- a/xdocs/miscellaneous/changelog.xml +++ b/xdocs/miscellaneous/changelog.xml @@ -72,6 +72,9 @@ <fix> Avoid a potential crash when processing OCSP URLs. (markt) </fix> + <fix> + Make the processing of OCSP responses more robust. (markt) + </fix> </changelog> </section> <section name="1.3.8" rtext="2026-06-15"> --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
