This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch 11.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/11.0.x by this push:
new ffa09a3bba Another robustness improvement for OCSP responses.
ffa09a3bba is described below
commit ffa09a3bba80b3ca2c65a97095af448c0bc72fa7
Author: Mark Thomas <[email protected]>
AuthorDate: Wed Sep 2 19:36:51 2026 +0100
Another robustness improvement for OCSP responses.
---
java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java
b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java
index 3a6f72c1a6..057164115d 100644
--- a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java
+++ b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java
@@ -1413,6 +1413,10 @@ public final class OpenSSLEngine extends SSLEngine
implements SSLUtil.ProtocolIn
MemorySegment nextUpdatePointer =
localArena.allocateFrom(ValueLayout.ADDRESS, MemorySegment.NULL);
int status = OCSP_single_get0_status(singleResponse,
MemorySegment.NULL, MemorySegment.NULL,
thisUpdatePointer, nextUpdatePointer);
+ if (status == -1) {
+ X509_STORE_CTX_set_error(x509ctx,
X509_V_ERR_OCSP_RESP_INVALID());
+ return V_OCSP_CERTSTATUS_UNKNOWN();
+ }
if
(OCSP_check_validity(thisUpdatePointer.get(ValueLayout.ADDRESS, 0),
nextUpdatePointer.get(ValueLayout.ADDRESS, 0),
OCSP_MAX_SKEW, -1) <= 0) {
X509_STORE_CTX_set_error(x509ctx,
X509_V_ERR_OCSP_NOT_YET_VALID());
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
