Use wolfSSL's EmbedOcspLookup in non-blocking async OCSP example#604
Use wolfSSL's EmbedOcspLookup in non-blocking async OCSP example#604night1rider wants to merge 1 commit into
Conversation
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #604
Scan targets checked: wolfssl-examples-bugs, wolfssl-examples-src
Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)
This review was generated automatically by Fenrir. Findings are non-blocking.
c7c49f3 to
8d7c242
Compare
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #604
Scan targets checked: wolfssl-examples-bugs, wolfssl-examples-src
Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)
This review was generated automatically by Fenrir. Findings are non-blocking.
…OCSP responder URL into a system() call, replace that with wolfSSL's EmbedOcspLookup so the untrusted URL is fetched over a socket as data instead of being executed. Resolve the default server by hostname with getaddrinfo instead of a hard-coded IP so the example keeps connecting as the address changes.
8d7c242 to
4011953
Compare
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #604
Scan targets checked: wolfssl-examples-bugs, wolfssl-examples-src
Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)
This review was generated automatically by Fenrir. Findings are non-blocking.
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #604
Scan targets checked: wolfssl-examples-bugs, wolfssl-examples-src
Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)
This review was generated automatically by Fenrir. Findings are non-blocking.
| FILE* mark = fopen("ocsp.req", "wb"); | ||
| if (mark == NULL) | ||
| return -1; | ||
| if (fclose(mark) != 0) |
There was a problem hiding this comment.
🔵 [Low] Orphaned marker file on fclose failure corrupts WANT_READ state machine · Logic errors
If fclose(mark) fails, the function returns -1 but ocsp.req already exists on disk. On the next invocation, access sees the file, the WANT_READ branch is skipped, and EmbedOcspLookup is called immediately — bypassing the non-blocking simulation entirely.
Fix: Call remove("ocsp.req") before returning -1 when fclose fails, to keep the marker-file state consistent.
2 participants
The callback built a curl command by interpolating the certificate's OCSP responder URL into a system() call, replace that with wolfSSL's EmbedOcspLookup so the untrusted URL is fetched over a socket as data instead of being executed.
Resolve the default server by hostname with getaddrinfo instead of a hard-coded IP so the example keeps connecting as the address changes.