/* Provenance: openssl/openssl check_cert_ocsp_resp (fixed).
 * repo: openssl/openssl
 * commit: 58633b658fe74095c8cdde191e4ce1bf94f8c5f9
 * parent: 68ef88913e321bdb47eee88118ceba18ed2388cd
 * commit_url: https://github.com/openssl/openssl/commit/58633b658fe74095c8cdde191e4ce1bf94f8c5f9
 * cve: CVE-2026-35188
 * license: Apache-2.0
 * function: check_cert_ocsp_resp
 * relpath: crypto/x509/x509_vfy.c
 */

static int check_cert_ocsp_resp(X509_STORE_CTX *ctx)
{
    int cert_status, crl_reason;
    int i;
    OCSP_RESPONSE *resp = NULL;
    OCSP_BASICRESP *bs = NULL;
    OCSP_SINGLERESP *sr = NULL;
    OCSP_CERTID *sr_cert_id = NULL;
    ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
    ASN1_OBJECT *cert_id_md_oid;
    EVP_MD *cert_id_md = NULL;
    OCSP_CERTID *cert_id = NULL;
    int ret = V_OCSP_CERTSTATUS_UNKNOWN;
    int num;

    num = sk_OCSP_RESPONSE_num(ctx->ocsp_resp);

    if (num < 0 || num <= ctx->error_depth)
        return X509_V_ERR_OCSP_NO_RESPONSE;

    if ((resp = sk_OCSP_RESPONSE_value(ctx->ocsp_resp, ctx->error_depth)) == NULL
        || (bs = OCSP_response_get1_basic(resp)) == NULL
        || (num = OCSP_resp_count(bs)) < 1)
        return X509_V_ERR_OCSP_NO_RESPONSE;

    if (OCSP_response_status(resp) != OCSP_RESPONSE_STATUS_SUCCESSFUL) {
        OCSP_BASICRESP_free(bs);
        bs = NULL;
        ret = X509_V_ERR_OCSP_RESP_INVALID;
        goto end;
    }

    if (OCSP_basic_verify(bs, ctx->chain, ctx->store, 0) <= 0) {
        ret = X509_V_ERR_OCSP_SIGNATURE_FAILURE;
        goto end;
    }

    /* find the right single response in the OCSP response */
    for (i = 0; i < num; i++) {
        sr = OCSP_resp_get0(bs, i);

        /* determine the md algorithm which was used to create cert id */
        sr_cert_id = (OCSP_CERTID *)OCSP_SINGLERESP_get0_id(sr);
        OCSP_id_get0_info(NULL, &cert_id_md_oid, NULL, NULL, sr_cert_id);
        if (cert_id_md_oid != NULL) {
            char md_name[80];

            if (i2t_ASN1_OBJECT(md_name, sizeof(md_name), cert_id_md_oid) > 0)
                cert_id_md = EVP_MD_fetch(ctx->libctx, md_name, ctx->propq);
        }

        /* search the stack for the requested OCSP response */
        cert_id = OCSP_cert_to_id(cert_id_md, ctx->current_cert, ctx->current_issuer);
        EVP_MD_free(cert_id_md);
        cert_id_md = NULL;
        if (cert_id == NULL) {
            ret = X509_V_ERR_OCSP_RESP_INVALID;
            goto end;
        }

        if (!OCSP_id_cmp(cert_id, sr_cert_id))
            break;

        OCSP_CERTID_free(cert_id);
        cert_id = NULL;
    }

    if (cert_id == NULL) {
        ret = X509_V_ERR_OCSP_NO_RESPONSE;
        goto end;
    }

    if (OCSP_resp_find_status(bs, cert_id, &cert_status, &crl_reason, &rev,
            &thisupd, &nextupd)
        <= 0) {
        ret = X509_V_ERR_OCSP_RESP_INVALID;
        goto end;
    }

    if (cert_status == V_OCSP_CERTSTATUS_GOOD) {
        /*
         * Note:
         * A OCSP stapling result will be accepted up to 5 minutes
         * after it expired!
         */
        if (!OCSP_check_validity(thisupd, nextupd, 300L, -1L))
            ret = X509_V_ERR_OCSP_HAS_EXPIRED;
        else
            ret = V_OCSP_CERTSTATUS_GOOD;
    } else {
        ret = cert_status;
    }

end:
    OCSP_CERTID_free(cert_id);
    OCSP_BASICRESP_free(bs);
    return ret;
}