| commit | a3a0cce8ee8c142cd148090854ca8551a36d9bd7 | [log] [tgz] |
|---|---|---|
| author | Remi Tricot-Le Breton <rlebreton@haproxy.com> | Wed Jun 09 17:16:18 2021 +0200 |
| committer | William Lallemand <wlallemand@haproxy.org> | Wed Jun 09 17:49:00 2021 +0200 |
| tree | a3ee1552e032d7e55503545cfde7c27b75131fd4 | |
| parent | 722180aca8757d8807b21cf125a2d68249be5bf8 [diff] |
BUG/MINOR: ssl: OCSP stapling does not work if expire too far in the future The wey the "Next Update" field of the OCSP response is converted into a timestamp relies on the use of signed integers for the year and month so if the calculated timestamp happens to overflow INT_MAX, it ends up being seen as negative and the OCSP response being dwignored in ssl_sock_ocsp_stapling_cbk (because of the "ocsp->expire < now.tv_sec" test). It could be backported to all stable branches.