mirror of
https://github.com/curl/curl.git
synced 2026-04-22 17:12:12 +03:00
8ec241bc99
Without it, subsequent OpenSSL API calls may fail with an error caught within the OpenSSL `d2i_X509()` (decode) call. It was seen to happen when importing from the Windows certificate store (e.g. with `--ca-native`), and any one of the certificates failed while decoding, then skipped. Behind the scene (and undocumented), the failed decode call is adding an error to an internal OpenSSL error queue. This error is picked up later, at the connect phase, by another OpenSSL API call, which happens to check the error queue, without clearing it first. It made the connect fail with the error collected earlier, while decoding the malformed and discarded certificate. Fix by explicitly clearing the error queue if the decode call fails. Ref: https://docs.openssl.org/3.5/man3/d2i_X509/ `-vvvv` output before this patch: ``` [0-0] == Info: successfully imported Windows ROOT store [0-0] == Info: successfully imported Windows CA store [0-0] == Info: [SSL] SSL_connect() -> err=-1, detail=1 [0-0] == Info: TLS connect error: error:068000DD:asn1 encoding routines::illegal padding [0-0] == Info: [SSL] cf_connect() -> 35, done=0 ``` Mainline OpenSSL (as of 3.5.2) and quictls (as of 3.3.0) are affected. LibreSSL is not affected. (I did not test BoringSSL and AWS-LC) Assisted-by: Stefan Eissing Reported-by: Michał Petryka Fixes #18190 Closes #18228 |
||
|---|---|---|
| .. | ||
| .checksrc | ||
| cipher_suite.c | ||
| cipher_suite.h | ||
| gtls.c | ||
| gtls.h | ||
| hostcheck.c | ||
| hostcheck.h | ||
| keylog.c | ||
| keylog.h | ||
| mbedtls.c | ||
| mbedtls.h | ||
| mbedtls_threadlock.c | ||
| mbedtls_threadlock.h | ||
| openssl.c | ||
| openssl.h | ||
| rustls.c | ||
| rustls.h | ||
| schannel.c | ||
| schannel.h | ||
| schannel_int.h | ||
| schannel_verify.c | ||
| vtls.c | ||
| vtls.h | ||
| vtls_int.h | ||
| vtls_scache.c | ||
| vtls_scache.h | ||
| vtls_spack.c | ||
| vtls_spack.h | ||
| wolfssl.c | ||
| wolfssl.h | ||
| x509asn1.c | ||
| x509asn1.h | ||