romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-22 22:47:17 +03:00
Code Issues Projects Releases Packages Wiki Activity

openssl: avoid overwriting 'result' after error

Browse source 
Follow-up to eefd03c572

Pointed out by ZeroPath https://zeropath.com/
Closes #19099
This commit is contained in:
Daniel Stenberg 2025-10-17 14:27:58 +02:00
parent 6296b9d383
commit fbff1d5b90
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
1 changed files with 13 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

25
lib/vtls/openssl.c
View file

@ -5106,12 +5106,6 @@ static CURLcode ossl_apple_verify(struct Curl_cfilter *cf,
{
struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
struct ossl_certs_ctx chain;
long ocsp_len = 0;
#ifdef HAVE_BORINGSSL_LIKE
const uint8_t *ocsp_data = NULL;
#else
unsigned char *ocsp_data = NULL;
#endif
CURLcode result;
memset(&chain, 0, sizeof(chain));
@ -5123,13 +5117,20 @@ static CURLcode ossl_apple_verify(struct Curl_cfilter *cf,
failf(data, "SSL: could not get peer certificate");
result = CURLE_PEER_FAILED_VERIFICATION;
}
else {
#ifdef HAVE_BORINGSSL_LIKE
const uint8_t *ocsp_data = NULL;
#else
unsigned char *ocsp_data = NULL;
#endif
long ocsp_len = 0;
if(conn_config->verifystatus && !octx->reused_session)
ocsp_len = (long)SSL_get_tlsext_status_ocsp_resp(octx->ssl, &ocsp_data);
if(conn_config->verifystatus && !octx->reused_session)
ocsp_len = (long)SSL_get_tlsext_status_ocsp_resp(octx->ssl, &ocsp_data);
result = Curl_vtls_apple_verify(cf, data, peer, chain.num_certs,
ossl_chain_get_der, &chain,
ocsp_data, ocsp_len);
result = Curl_vtls_apple_verify(cf, data, peer, chain.num_certs,
ossl_chain_get_der, &chain,
ocsp_data, ocsp_len);
}
*pverified = !result;
return result;
}