From 0db8f86a18925bd239600a4e3cd5dc31de31258f Mon Sep 17 00:00:00 2001 From: Dmitry Belyavskiy Date: Fri, 22 Feb 2019 16:58:55 +0300 Subject: [PATCH] Add some checks of OCSP functions Reviewed-by: Tim Hudson Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/openssl/pull/8308) (cherry picked from commit 72b89b8e201d17dea0219b4b92df7af7e17f183a) --- apps/ocsp.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/apps/ocsp.c b/apps/ocsp.c index e8aeb11cc5..066a2e43af 100644 --- a/apps/ocsp.c +++ b/apps/ocsp.c @@ -641,8 +641,10 @@ redo_accept: goto end; } - if (req != NULL && add_nonce) - OCSP_request_add1_nonce(req, NULL, -1); + if (req != NULL && add_nonce) { + if (!OCSP_request_add1_nonce(req, NULL, -1)) + goto end; + } if (signfile != NULL) { if (keyfile == NULL) @@ -1245,7 +1247,10 @@ static void make_ocsp_response(BIO *err, OCSP_RESPONSE **resp, OCSP_REQUEST *req goto end; } } - OCSP_basic_sign_ctx(bs, rcert, mctx, rother, flags); + if (!OCSP_basic_sign_ctx(bs, rcert, mctx, rother, flags)) { + *resp = OCSP_response_create(OCSP_RESPONSE_STATUS_INTERNALERROR, bs); + goto end; + } if (badsig) { const ASN1_OCTET_STRING *sig = OCSP_resp_get0_signature(bs); -- 2.25.1