This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch 1.3.x
in repository https://gitbox.apache.org/repos/asf/tomcat-native.git
The following commit(s) were added to refs/heads/1.3.x by this push:
new 978fb203b Another robustness improvement for OCSP responses.
978fb203b is described below
commit 978fb203ba485ea8cc9117f52123d225107d4c57
Author: Mark Thomas <[email protected]>
AuthorDate: Fri Aug 28 18:24:32 2026 +0100
Another robustness improvement for OCSP responses.
---
native/src/sslutils.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/native/src/sslutils.c b/native/src/sslutils.c
index 5d8e0ad48..9580624df 100644
--- a/native/src/sslutils.c
+++ b/native/src/sslutils.c
@@ -1123,6 +1123,11 @@ static int process_ocsp_response(OCSP_REQUEST *ocsp_req,
OCSP_RESPONSE *ocsp_res
ss = OCSP_resp_get0(bs, OCSP_resp_find(bs, certid, -1)); /* find by serial
number and get the matching response */
i = OCSP_single_get0_status(ss, NULL, NULL, &thisupd, &nextupd);
+ if (i == -1) {
+ X509_STORE_CTX_set_error(ctx, X509_V_ERR_OCSP_RESP_INVALID);
+ o = OCSP_STATUS_UNKNOWN;
+ goto clean_certid;
+ }
if (OCSP_check_validity(thisupd, nextupd, OCSP_MAX_SKEW, -1) <= 0) {
X509_STORE_CTX_set_error(ctx, X509_V_ERR_OCSP_NOT_YET_VALID);
o = OCSP_STATUS_UNKNOWN;
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
