]> git.ipfire.org Git - thirdparty/strongswan.git/commit
x509: Correctly handle missing responder ID when parsing OCSP response errors
authorTobias Brunner <tobias@strongswan.org>
Thu, 23 Nov 2023 10:32:15 +0000 (11:32 +0100)
committerTobias Brunner <tobias@strongswan.org>
Fri, 24 Nov 2023 16:41:18 +0000 (17:41 +0100)
commit585c40095a3a92e058c5d1d61137232f17f72195
tree07fad42cacacaaf5b63826dada99b47f4936b7dd
parentda45cf9f38207af7dced1762747c2d79ef3a3d02
x509: Correctly handle missing responder ID when parsing OCSP response errors

The has_issuer() and issued_by() methods relied on it to be defined, so
if the OCSP response wasn't successful (i.e. OCSP status indicates an
error and no OCSP response is parsed), a null-pointer dereference was
caused if the caller checked if the OCSP response was issued by a
specific certificate.

That's a side-effect of the referenced commit.  Previously, error codes
caused the OCSP response to not get parsed successfully, which technically
wasn't correct as it's well formed and successfully parsed, it's just
indicating an error state.

Fixes: 00ab8d62c089 ("x509: Support generation of OCSP responses")
src/libstrongswan/plugins/x509/x509_ocsp_response.c