[openssl/openssl] 155b5f: x509: fix OCSP BasicResponse leak in in-verify check

  Branch: refs/heads/openssl-3.6
  Home:   https://github.com/openssl/openssl
  Commit: 155b5fe0f93365e6df1c56ee3606b121080c6c12
      https://github.com/openssl/openssl/commit/155b5fe0f93365e6df1c56ee3606b121080c6c12
  Author: Mounir IDRASSI <[email protected]>
  Date:   2026-08-03 (Mon, 03 Aug 2026)

  Changed paths:
    M crypto/x509/x509_vfy.c

  Log Message:
  -----------
  x509: fix OCSP BasicResponse leak in in-verify check

In check_cert_ocsp_resp(), OCSP_response_get1_basic() returns an owning
OCSP_BASICRESP. The combined-condition early return on
OCSP_resp_count(bs) < 1 bypassed the end: cleanup label, leaking bs when
a stapled OCSP response decoded to a BasicResponse with no single
responses.

Separate the count check from the acquisition and route the empty case
through end: (ret = X509_V_ERR_OCSP_NO_RESPONSE; goto end;) so bs is
freed while preserving the previous return value. Reachable only with
the non-default X509_V_FLAG_OCSP_RESP_CHECK with peer-supplied (e.g.
TLS 1.3 stapled) responses.

Reported-by: geeknik (https://github.com/geeknik)
Suggested-by: geeknik (https://github.com/geeknik)
Fixes #31759

Reviewed-by: Andrew Dinh <[email protected]>
Reviewed-by: Daniel Kubec <[email protected]>
MergeDate: Mon Aug  3 07:03:00 2026
(Merged from https://github.com/openssl/openssl/pull/31764)



To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/openssl-3.6/825236-155b5f%40github.com.