fbff1d5b90 — curl

Subject

openssl: avoid overwriting 'result' after error

No binary (build failed)

Architecture: x86_64-linux-gnu Compiler: gcc (Ubuntu 11.4.0-1ubuntu1~22.04.3) 11.4.0

—

(log yok)

lib/vtls/openssl.c+13 -12

@@ -5106,12 +5106,6 @@ static CURLcode ossl_apple_verify(struct Curl_cfilter *cf,
	{
	struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
	struct ossl_certs_ctx chain;
-	long ocsp_len = 0;
-	#ifdef HAVE_BORINGSSL_LIKE
-	const uint8_t *ocsp_data = NULL;
-	#else
-	unsigned char *ocsp_data = NULL;
-	#endif
	CURLcode result;

	memset(&chain, 0, sizeof(chain));
@@ -5123,13 +5117,20 @@ static CURLcode ossl_apple_verify(struct Curl_cfilter *cf,
	failf(data, "SSL: could not get peer certificate");
	result = CURLE_PEER_FAILED_VERIFICATION;
	}
+	else {
+	#ifdef HAVE_BORINGSSL_LIKE
+	const uint8_t *ocsp_data = NULL;
+	#else
+	unsigned char *ocsp_data = NULL;
+	#endif
+	long ocsp_len = 0;
+	if(conn_config->verifystatus && !octx->reused_session)
+	ocsp_len = (long)SSL_get_tlsext_status_ocsp_resp(octx->ssl, &ocsp_data);

-	if(conn_config->verifystatus && !octx->reused_session)
-	ocsp_len = (long)SSL_get_tlsext_status_ocsp_resp(octx->ssl, &ocsp_data);
-
-	result = Curl_vtls_apple_verify(cf, data, peer, chain.num_certs,
-	ossl_chain_get_der, &chain,
-	ocsp_data, ocsp_len);
+	result = Curl_vtls_apple_verify(cf, data, peer, chain.num_certs,
+	ossl_chain_get_der, &chain,
+	ocsp_data, ocsp_len);
+	}
	*pverified = !result;
	return result;
	}