[openssl/openssl] 3693c3: x509: fix OCSP BasicResponse leak in in-verify check

  Branch: refs/heads/master
  Home:   https://github.com/openssl/openssl
  Commit: 3693c35ffd07b09e096435521ad27ee7a43a6e08
      https://github.com/openssl/openssl/commit/3693c35ffd07b09e096435521ad27ee7a43a6e08
  Author: Mounir IDRASSI <[email protected]>
  Date:   2026-08-03 (Mon, 03 Aug 2026)

  Changed paths:
    M crypto/x509/x509_vfy.c

  Log Message:
  -----------
  x509: fix OCSP BasicResponse leak in in-verify check

In check_cert_ocsp_resp(), OCSP_response_get1_basic() returns an owning
OCSP_BASICRESP. The combined-condition early return on
OCSP_resp_count(bs) < 1 bypassed the end: cleanup label, leaking bs when
a stapled OCSP response decoded to a BasicResponse with no single
responses.

Separate the count check from the acquisition and route the empty case
through end: (ret = X509_V_ERR_OCSP_NO_RESPONSE; goto end;) so bs is
freed while preserving the previous return value. Reachable only with
the non-default X509_V_FLAG_OCSP_RESP_CHECK with peer-supplied (e.g.
TLS 1.3 stapled) responses.

Reported-by: geeknik (https://github.com/geeknik)
Suggested-by: geeknik (https://github.com/geeknik)
Fixes #31759

Reviewed-by: Andrew Dinh <[email protected]>
Reviewed-by: Daniel Kubec <[email protected]>
MergeDate: Mon Aug  3 07:02:30 2026
(Merged from https://github.com/openssl/openssl/pull/31764)



To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/master/2d2363-3693c3%40github.com.