www/apache
1
0
Fork 0
mirror of https://github.com/apache/httpd.git synced 2026-01-06 09:01:14 +03:00
Code Activity

mod_ssl: Fix recognition of OCSP stapling responses that are encoded

Browse Source 
improperly or too large.

The one byte "ok" flag stored with the response was accounted for in
the wrong condition.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1641077 13f79535-47bb-0310-9956-ffa450edef68
This commit is contained in:
Jeff Trawick
2014-11-22 14:51:01 +00:00
parent b40c9d5167
commit 70b441b9df
2 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
CHANGES
View File

@@ -5,6 +5,9 @@ Changes with Apache 2.5.0
mod_proxy_fcgi: Fix a potential crash with response headers' size above
8K. [Teguh <chain rop.io>, Yann Ylavic, Jeff Trawick]
*) mod_ssl: Fix recognition of OCSP stapling responses that are encoded
improperly or too large. [Jeff Trawick]
*) mod_proxy_fcgi, mod_authnz_fcgi: stop reading the response and issue an
error when parsing or forwarding the response fails. [Yann Ylavic]

6
modules/ssl/ssl_util_stapling.c
View File

@@ -210,13 +210,13 @@ static BOOL stapling_cache_response(server_rec *s, modssl_ctx_t *mctx,
BOOL ok, apr_pool_t *pool)
{
SSLModConfigRec *mc = myModConfig(s);
unsigned char resp_der[MAX_STAPLING_DER];
unsigned char resp_der[MAX_STAPLING_DER]; /* includes one-byte flag + response */
unsigned char *p;
int resp_derlen;
BOOL rv;
apr_time_t expiry;
resp_derlen = i2d_OCSP_RESPONSE(rsp, NULL) + 1;
resp_derlen = i2d_OCSP_RESPONSE(rsp, NULL);
if (resp_derlen <= 0) {
ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(01927)
@@ -224,7 +224,7 @@ static BOOL stapling_cache_response(server_rec *s, modssl_ctx_t *mctx,
return FALSE;
}
if (resp_derlen > sizeof resp_der) {
if (resp_derlen + 1 > sizeof resp_der) { /* response + ok flag too big? */
ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(01928)
"OCSP stapling response too big (%u bytes)", resp_derlen);
return FALSE;