gtls: fix ignored return and uninitialized status in OCSP check#21679
Closed
MegaManSec wants to merge 1 commit into
Closed
gtls: fix ignored return and uninitialized status in OCSP check#21679MegaManSec wants to merge 1 commit into
MegaManSec wants to merge 1 commit into
Conversation
gnutls_ocsp_resp_get_single() was called with (void) discarding its return value, so a failure (e.g. an OCSP response with no SingleResponse entries) went undetected. The following switch() then read an uninitialized gnutls_ocsp_cert_status_t, which is undefined behaviour and could yield GNUTLS_OCSP_CERT_GOOD (0) depending on stack contents, causing gtls_verify_ocsp_status to return CURLE_OK for a response that was never successfully parsed. Fix by initializing status to GNUTLS_OCSP_CERT_UNKNOWN and treating a negative return from gnutls_ocsp_resp_get_single as an error.
bagder
approved these changes
May 19, 2026
Member
|
Seeing as the two checkboxes are still not checked, do you want to wait for some further confirmation or should we merge this as-is? |
Contributor
Author
|
@bagder checked the checkboxes |
Member
|
Thanks! |
outcast36
pushed a commit
to greearb/curl
that referenced
this pull request
Jun 3, 2026
gnutls_ocsp_resp_get_single() was called with (void) discarding its return value, so a failure (e.g. an OCSP response with no SingleResponse entries) went undetected. The following switch() then read an uninitialized gnutls_ocsp_cert_status_t, which is undefined behaviour and could yield GNUTLS_OCSP_CERT_GOOD (0) depending on stack contents, causing gtls_verify_ocsp_status to return CURLE_OK for a response that was never successfully parsed. Fix by initializing status to GNUTLS_OCSP_CERT_UNKNOWN and treating a negative return from gnutls_ocsp_resp_get_single as an error. Closes curl#21679
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two correctness bugs in
gtls_verify_ocsp_status(lib/vtls/gtls.c), both introduced by aeb1a28:gnutls_ocsp_resp_get_single()was called with(void), silently discarding its return value. An OCSP response with zeroSingleResponseentries (or any other parse failure) went undetected.gnutls_ocsp_cert_status_t statuswas declared but never initialised. Whengnutls_ocsp_resp_get_single()failed, the subsequentswitch(status)read uninitialised memory — undefined behaviour that could yieldGNUTLS_OCSP_CERT_GOOD(0) depending on stack contents, causing the function to returnCURLE_OKfor a response that was never successfully parsed.These bugs only affect the
verifypeer=OFF, verifystatus=ONconfiguration; withverifypeer=ON,gnutls_certificate_verify_peers2()validates the OCSP response before this function is reached. They are correctness/robustness bugs, not security vulnerabilities.Fix
statustoGNUTLS_OCSP_CERT_UNKNOWNso theswitchalways has a defined, safe value.gnutls_ocsp_resp_get_single()and treat failure asCURLE_SSL_INVALIDCERTSTATUS, consistent with all other error checks in the function.Test plan