From afe9fee88ccb851a57ad8b32b2c6b6a25248f4d9 Mon Sep 17 00:00:00 2001 From: Kaspar Brand Date: Mon, 21 Apr 2014 06:54:41 +0000 Subject: [PATCH] ssl_stapling_init_cert: do not return success when no responder URI is found stapling_renew_response: abort early (before apr_uri_parse) if ocspuri is empty git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1588853 13f79535-47bb-0310-9956-ffa450edef68 --- docs/log-message-tags/next-number | 2 +- modules/ssl/ssl_util_stapling.c | 14 +++++++++++--- 2 files changed, 12 insertions(+), 4 deletions(-) diff --git a/docs/log-message-tags/next-number b/docs/log-message-tags/next-number index 7dabb45b39..f76b278913 100644 --- a/docs/log-message-tags/next-number +++ b/docs/log-message-tags/next-number @@ -1 +1 @@ -2621 +2622 diff --git a/modules/ssl/ssl_util_stapling.c b/modules/ssl/ssl_util_stapling.c index 7633648ce2..2dc8fceaaa 100644 --- a/modules/ssl/ssl_util_stapling.c +++ b/modules/ssl/ssl_util_stapling.c @@ -145,14 +145,15 @@ int ssl_stapling_init_cert(server_rec *s, modssl_ctx_t *mctx, X509 *x) X509_digest(x, EVP_sha1(), cinf->idx, NULL); aia = X509_get1_ocsp(x); - if (aia) + if (aia) { cinf->uri = sk_OPENSSL_STRING_pop(aia); + X509_email_free(aia); + } if (!cinf->uri && !mctx->stapling_force_url) { ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(02218) "ssl_stapling_init_cert: no responder URL"); + return 0; } - if (aia) - X509_email_free(aia); return 1; } @@ -403,6 +404,13 @@ static BOOL stapling_renew_response(server_rec *s, modssl_ctx_t *mctx, SSL *ssl, else ocspuri = cinf->uri; + if (!ocspuri) { + ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(02621) + "stapling_renew_response: no uri for responder"); + rv = FALSE; + goto done; + } + /* Create a temporary pool to constrain memory use */ apr_pool_create(&vpool, conn->pool); -- 2.50.1