From 6ab52f7c8951747b0379e63a440ca37cca658467 Mon Sep 17 00:00:00 2001
From: Stefan Eissing <stefan@eissing.org>
Date: Thu, 2 Jul 2026 13:11:35 +0200
Subject: [PATCH] openssl+sectrust: move session verified set into result check

Pointed out by Codex Security
Closes #22248
---
 lib/vtls/openssl.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c
index cd8d43523a..10e3946bdf 100644
--- a/lib/vtls/openssl.c
+++ b/lib/vtls/openssl.c
@@ -2689,10 +2689,10 @@ CURLcode Curl_ossl_add_session(struct Curl_cfilter *cf,
                                       earlydata_max, qtp_clone, quic_tp_len,
                                       &sc_session);
     der_session_buf = NULL;  /* took ownership of sdata */
-#ifdef USE_APPLE_SECTRUST
-    sc_session->sectrust_verified = octx->sectrust_verified;
-#endif
     if(!result) {
+#ifdef USE_APPLE_SECTRUST
+      sc_session->sectrust_verified = octx->sectrust_verified;
+#endif
       result = Curl_ssl_scache_put(cf, data, ssl_peer_key, sc_session);
       /* took ownership of `sc_session` */
     }