mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-18 20:49:28 +00:00
Marius Ciepluch
0116f9bea6
Harvest 176 isolated vuln-vs-fix functions (109 CVEs, 352 training rows) into benchmarks/pairs/vfc with provenance and a JSONL training manifest. Score the slice as an honesty dashboard (ousast pairs --slice vfc); keep the pair gate on the local fixtures only.
110 lines
3.3 KiB
C
110 lines
3.3 KiB
C
/* Provenance: openssl/openssl check_cert_ocsp_resp (fixed).
|
|
* repo: openssl/openssl
|
|
* commit: 58633b658fe74095c8cdde191e4ce1bf94f8c5f9
|
|
* parent: 68ef88913e321bdb47eee88118ceba18ed2388cd
|
|
* commit_url: https://github.com/openssl/openssl/commit/58633b658fe74095c8cdde191e4ce1bf94f8c5f9
|
|
* cve: CVE-2026-35188
|
|
* license: Apache-2.0
|
|
* function: check_cert_ocsp_resp
|
|
* relpath: crypto/x509/x509_vfy.c
|
|
*/
|
|
|
|
static int check_cert_ocsp_resp(X509_STORE_CTX *ctx)
|
|
{
|
|
int cert_status, crl_reason;
|
|
int i;
|
|
OCSP_RESPONSE *resp = NULL;
|
|
OCSP_BASICRESP *bs = NULL;
|
|
OCSP_SINGLERESP *sr = NULL;
|
|
OCSP_CERTID *sr_cert_id = NULL;
|
|
ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
|
|
ASN1_OBJECT *cert_id_md_oid;
|
|
EVP_MD *cert_id_md = NULL;
|
|
OCSP_CERTID *cert_id = NULL;
|
|
int ret = V_OCSP_CERTSTATUS_UNKNOWN;
|
|
int num;
|
|
|
|
num = sk_OCSP_RESPONSE_num(ctx->ocsp_resp);
|
|
|
|
if (num < 0 || num <= ctx->error_depth)
|
|
return X509_V_ERR_OCSP_NO_RESPONSE;
|
|
|
|
if ((resp = sk_OCSP_RESPONSE_value(ctx->ocsp_resp, ctx->error_depth)) == NULL
|
|
|| (bs = OCSP_response_get1_basic(resp)) == NULL
|
|
|| (num = OCSP_resp_count(bs)) < 1)
|
|
return X509_V_ERR_OCSP_NO_RESPONSE;
|
|
|
|
if (OCSP_response_status(resp) != OCSP_RESPONSE_STATUS_SUCCESSFUL) {
|
|
OCSP_BASICRESP_free(bs);
|
|
bs = NULL;
|
|
ret = X509_V_ERR_OCSP_RESP_INVALID;
|
|
goto end;
|
|
}
|
|
|
|
if (OCSP_basic_verify(bs, ctx->chain, ctx->store, 0) <= 0) {
|
|
ret = X509_V_ERR_OCSP_SIGNATURE_FAILURE;
|
|
goto end;
|
|
}
|
|
|
|
/* find the right single response in the OCSP response */
|
|
for (i = 0; i < num; i++) {
|
|
sr = OCSP_resp_get0(bs, i);
|
|
|
|
/* determine the md algorithm which was used to create cert id */
|
|
sr_cert_id = (OCSP_CERTID *)OCSP_SINGLERESP_get0_id(sr);
|
|
OCSP_id_get0_info(NULL, &cert_id_md_oid, NULL, NULL, sr_cert_id);
|
|
if (cert_id_md_oid != NULL) {
|
|
char md_name[80];
|
|
|
|
if (i2t_ASN1_OBJECT(md_name, sizeof(md_name), cert_id_md_oid) > 0)
|
|
cert_id_md = EVP_MD_fetch(ctx->libctx, md_name, ctx->propq);
|
|
}
|
|
|
|
/* search the stack for the requested OCSP response */
|
|
cert_id = OCSP_cert_to_id(cert_id_md, ctx->current_cert, ctx->current_issuer);
|
|
EVP_MD_free(cert_id_md);
|
|
cert_id_md = NULL;
|
|
if (cert_id == NULL) {
|
|
ret = X509_V_ERR_OCSP_RESP_INVALID;
|
|
goto end;
|
|
}
|
|
|
|
if (!OCSP_id_cmp(cert_id, sr_cert_id))
|
|
break;
|
|
|
|
OCSP_CERTID_free(cert_id);
|
|
cert_id = NULL;
|
|
}
|
|
|
|
if (cert_id == NULL) {
|
|
ret = X509_V_ERR_OCSP_NO_RESPONSE;
|
|
goto end;
|
|
}
|
|
|
|
if (OCSP_resp_find_status(bs, cert_id, &cert_status, &crl_reason, &rev,
|
|
&thisupd, &nextupd)
|
|
<= 0) {
|
|
ret = X509_V_ERR_OCSP_RESP_INVALID;
|
|
goto end;
|
|
}
|
|
|
|
if (cert_status == V_OCSP_CERTSTATUS_GOOD) {
|
|
/*
|
|
* Note:
|
|
* A OCSP stapling result will be accepted up to 5 minutes
|
|
* after it expired!
|
|
*/
|
|
if (!OCSP_check_validity(thisupd, nextupd, 300L, -1L))
|
|
ret = X509_V_ERR_OCSP_HAS_EXPIRED;
|
|
else
|
|
ret = V_OCSP_CERTSTATUS_GOOD;
|
|
} else {
|
|
ret = cert_status;
|
|
}
|
|
|
|
end:
|
|
OCSP_CERTID_free(cert_id);
|
|
OCSP_BASICRESP_free(bs);
|
|
return ret;
|
|
}
|