From e66c37deb64d4e4ab0c2d63b817760d387eb9ed8 Mon Sep 17 00:00:00 2001 From: Matt Caswell Date: Wed, 1 Apr 2020 16:10:08 +0100 Subject: Explicitly cache the X509v3_extensions in one more place in libssl Make sure we cache the extensions for a cert using the right libctx. Reviewed-by: Richard Levitte Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/11457) --- ssl/ssl_rsa.c | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'ssl/ssl_rsa.c') diff --git a/ssl/ssl_rsa.c b/ssl/ssl_rsa.c index ac9d01a766..09b965fc19 100644 --- a/ssl/ssl_rsa.c +++ b/ssl/ssl_rsa.c @@ -1055,9 +1055,15 @@ static int ssl_set_cert_and_key(SSL *ssl, SSL_CTX *ctx, X509 *x509, EVP_PKEY *pr int j; int rv; CERT *c = ssl != NULL ? ssl->cert : ctx->cert; + SSL_CTX *actualctx = ssl == NULL ? ctx : ssl->ctx; STACK_OF(X509) *dup_chain = NULL; EVP_PKEY *pubkey = NULL; + if (!X509v3_cache_extensions(x509, actualctx->libctx, actualctx->propq)) { + SSLerr(0, ERR_R_X509_LIB); + goto out; + } + /* Do all security checks before anything else */ rv = ssl_security_cert(ssl, ctx, x509, 0, 1); if (rv != 1) { -- cgit v1.2.3