From: Dr. David von Oheimb Date: Wed, 22 Oct 2025 13:28:29 +0000 (+0200) Subject: cmp_vfy.c: fix crash on attempting to use invalidated sender cert on producing diagno... X-Git-Tag: openssl-4.0.0~106 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a41a1fdcd7cc4b28a1c3c37a890972adaaff3e8a;p=thirdparty%2Fopenssl.git cmp_vfy.c: fix crash on attempting to use invalidated sender cert on producing diagnostic information Reviewed-by: Neil Horman Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/28973) (cherry picked from commit 7d926166de0a86d3aae716c682fa295722e04f49) --- diff --git a/crypto/cmp/cmp_vfy.c b/crypto/cmp/cmp_vfy.c index 01c7422c387..16541d1af33 100644 --- a/crypto/cmp/cmp_vfy.c +++ b/crypto/cmp/cmp_vfy.c @@ -507,11 +507,11 @@ static int check_msg_find_cert(OSSL_CMP_CTX *ctx, const OSSL_CMP_MSG *msg) return 1; } /* cached sender cert has shown to be no more successfully usable */ - (void)ossl_cmp_ctx_set1_validatedSrvCert(ctx, NULL); /* re-do the above check (just) for adding diagnostic information */ ossl_cmp_info(ctx, "trying to verify msg signature with previously validated cert"); (void)check_msg_given_cert(ctx, scrt, msg); + (void)ossl_cmp_ctx_set1_validatedSrvCert(ctx, NULL); /* this invalidates scrt */ } res = check_msg_all_certs(ctx, msg, 0 /* using ctx->trusted */)