romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-15 11:03:56 +03:00
Code Issues Projects Releases Packages Wiki Activity

openssl: fail the transfer if ossl_certchain() fails

Browse source 
Since it would indicate errors to the degree that continuing would just
risk hiding the earlier errors or make things weird.

Inspired by a report in Joshua's sarif data

Closes #18646
This commit is contained in:
Daniel Stenberg 2025-09-20 22:32:23 +02:00
parent e27853d36b
commit 16e0a2098d
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
1 changed files with 11 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

17
lib/vtls/openssl.c
View file

@ -355,9 +355,8 @@ static CURLcode ossl_certchain(struct Curl_easy *data, SSL *ssl)
DEBUGASSERT(ssl);
sk = SSL_get_peer_cert_chain(ssl);
if(!sk) {
return CURLE_OUT_OF_MEMORY;
}
if(!sk)
return CURLE_SSL_CONNECT_ERROR;
numcerts = sk_X509_num(sk);
@ -4856,9 +4855,15 @@ CURLcode Curl_ossl_check_peer_cert(struct Curl_cfilter *cf,
return CURLE_OUT_OF_MEMORY;
}
if(data->set.ssl.certinfo)
/* asked to gather certificate info */
(void)ossl_certchain(data, octx->ssl);
if(data->set.ssl.certinfo && !octx->reused_session) {
/* asked to gather certificate info. Reused sessions don't have cert
chains */
result = ossl_certchain(data, octx->ssl);
if(result) {
BIO_free(mem);
return result;
}
}
octx->server_cert = SSL_get1_peer_certificate(octx->ssl);
if(!octx->server_cert) {