diff options
| author | Dr. David von Oheimb <David.von.Oheimb@siemens.com> | 2020-08-12 19:16:03 +0200 |
|---|---|---|
| committer | Dr. David von Oheimb <David.von.Oheimb@siemens.com> | 2020-08-21 09:04:11 +0200 |
| commit | 2300083887342650e1ad8071855d87a0e814dba4 (patch) | |
| tree | 1a8cbdccb0a8faf18d0f336902ebced749b9b727 /crypto/cmp/cmp_ctx.c | |
| parent | ab28b59064b3f46c7a62b540cd17cad718738108 (diff) | |
crypto/cmp: Prevent misleading errors in case x509v3_cache_extensions() fails
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11808)
Diffstat (limited to 'crypto/cmp/cmp_ctx.c')
| -rw-r--r-- | crypto/cmp/cmp_ctx.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/crypto/cmp/cmp_ctx.c b/crypto/cmp/cmp_ctx.c index 5b9c0f3120..0d15551e35 100644 --- a/crypto/cmp/cmp_ctx.c +++ b/crypto/cmp/cmp_ctx.c @@ -12,6 +12,7 @@ #include <openssl/trace.h> #include <openssl/bio.h> #include <openssl/ocsp.h> /* for OCSP_REVOKED_STATUS_* */ +#include "crypto/x509.h" /* for x509v3_cache_extensions() */ #include "cmp_local.h" @@ -579,6 +580,8 @@ int OSSL_CMP_CTX_set1_##FIELD(OSSL_CMP_CTX *ctx, const TYPE *val) \ return 1; \ } +#define X509_invalid(cert) (!x509v3_cache_extensions(cert)) +#define EVP_PKEY_invalid(key) 0 #define DEFINE_OSSL_CMP_CTX_set1_up_ref(FIELD, TYPE) \ int OSSL_CMP_CTX_set1_##FIELD(OSSL_CMP_CTX *ctx, TYPE *val) \ { \ @@ -587,6 +590,11 @@ int OSSL_CMP_CTX_set1_##FIELD(OSSL_CMP_CTX *ctx, TYPE *val) \ return 0; \ } \ \ + /* prevent misleading error later on malformed cert or provider issue */ \ + if (val != NULL && TYPE##_invalid(val)) { \ + CMPerr(0, CMP_R_POTENTIALLY_INVALID_CERTIFICATE); \ + return 0; \ + } \ if (val != NULL && !TYPE##_up_ref(val)) \ return 0; \ TYPE##_free(ctx->FIELD); \ |