tree 6f768328c6e4c16263e75bc16f4d35284f070a11
parent e77a13aa3f82f70e9f82e712287390d500bd0c8b
author Willy Tarreau <w@1wt.eu> 1580821322 +0100
committer Willy Tarreau <w@1wt.eu> 1580821476 +0100
encoding latin1

BUG/MINOR: ssl: we may only ignore the first 64 errors

We have the ability per bind option to ignore certain errors (CA, crt, ...),
and for this we use a 64-bit field. In issue #479 coverity reports a risk of
too large a left shift. For now as of OpenSSL 1.1.1 the highest error value
that may be reported by X509_STORE_CTX_get_error() seems to be around 50 so
there should be no risk yet, but it's enough of a warning to add a check so
that we don't accidently hide random errors in the future.

This may be backported to relevant stable branches.