You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by ma...@apache.org on 2026/08/28 17:12:21 UTC
(tomcat-native) 01/02: Make the processing of OCSP responses more robust
This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch 1.3.x
in repository https://gitbox.apache.org/repos/asf/tomcat-native.git
commit 5a3a81a37c53475e185a3ca9478a3c980be8f6a7
Author: Mark Thomas <ma...@apache.org>
AuthorDate: Fri Aug 28 18:11:00 2026 +0100
Make the processing of OCSP responses more robust
---
native/src/sslutils.c | 4 ++++
xdocs/miscellaneous/changelog.xml | 3 +++
2 files changed, 7 insertions(+)
diff --git a/native/src/sslutils.c b/native/src/sslutils.c
index b17638ffc..ddf87e59e 100644
--- a/native/src/sslutils.c
+++ b/native/src/sslutils.c
@@ -1096,6 +1096,10 @@ static int process_ocsp_response(OCSP_REQUEST *ocsp_req, OCSP_RESPONSE *ocsp_res
}
bs = OCSP_response_get1_basic(ocsp_resp);
+ if (bs == NULL) {
+ X509_STORE_CTX_set_error(ctx, X509_V_ERR_OCSP_RESP_INVALID);
+ return OCSP_STATUS_UNKNOWN;
+ }
if (OCSP_check_nonce(ocsp_req, bs) == 0) {
X509_STORE_CTX_set_error(ctx, X509_V_ERR_OCSP_RESP_INVALID);
o = OCSP_STATUS_UNKNOWN;
diff --git a/xdocs/miscellaneous/changelog.xml b/xdocs/miscellaneous/changelog.xml
index 15735566e..b1ecedd78 100644
--- a/xdocs/miscellaneous/changelog.xml
+++ b/xdocs/miscellaneous/changelog.xml
@@ -72,6 +72,9 @@
<fix>
Avoid a potential crash when processing OCSP URLs. (markt)
</fix>
+ <fix>
+ Make the processing of OCSP responses more robust. (markt)
+ </fix>
</changelog>
</section>
<section name="1.3.8" rtext="2026-06-15">
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org