tree a3ee1552e032d7e55503545cfde7c27b75131fd4
parent 722180aca8757d8807b21cf125a2d68249be5bf8
author Remi Tricot-Le Breton <rlebreton@haproxy.com> 1623251778 +0200
committer William Lallemand <wlallemand@haproxy.org> 1623253740 +0200

BUG/MINOR: ssl: OCSP stapling does not work if expire too far in the future

The wey the "Next Update" field of the OCSP response is converted into a
timestamp relies on the use of signed integers for the year and month so
if the calculated timestamp happens to overflow INT_MAX, it ends up
being seen as negative and the OCSP response being dwignored in
ssl_sock_ocsp_stapling_cbk (because of the "ocsp->expire < now.tv_sec"
test).

It could be backported to all stable branches.