This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch 10.1.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/10.1.x by this push:
new a1a0d1fd5e Another robustness improvement for OCSP responses.
a1a0d1fd5e is described below
commit a1a0d1fd5ef8107389b2c6dd7159de5d0cdeb0c2
Author: Mark Thomas <[email protected]>
AuthorDate: Wed Sep 2 19:36:51 2026 +0100
Another robustness improvement for OCSP responses.
---
java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java
b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java
index 3206cfbbbc..d83658ae9c 100644
--- a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java
+++ b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java
@@ -1413,6 +1413,10 @@ public final class OpenSSLEngine extends SSLEngine
implements SSLUtil.ProtocolIn
MemorySegment nextUpdatePointer =
localArena.allocateFrom(ValueLayout.ADDRESS, MemorySegment.NULL);
int status = OCSP_single_get0_status(singleResponse,
MemorySegment.NULL, MemorySegment.NULL,
thisUpdatePointer, nextUpdatePointer);
+ if (status == -1) {
+ X509_STORE_CTX_set_error(x509ctx,
X509_V_ERR_OCSP_RESP_INVALID());
+ return V_OCSP_CERTSTATUS_UNKNOWN();
+ }
if
(OCSP_check_validity(thisUpdatePointer.get(ValueLayout.ADDRESS, 0),
nextUpdatePointer.get(ValueLayout.ADDRESS, 0),
OCSP_MAX_SKEW, -1) <= 0) {
X509_STORE_CTX_set_error(x509ctx,
X509_V_ERR_OCSP_NOT_YET_VALID());
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
