BUG/MINOR: ssl: Add missing return value check in ssl_ocsp_response_print
The b_istput function called to append the last data block to the end of
an OCSP response's detailed output was not checked in
ssl_ocsp_response_print. The ssl_ocsp_response_print return value checks
were added as well since some of them were missing.
This error was raised by Coverity (CID 1469513).
This patch fixes GitHub issue #1541.
It can be backported to 2.5.
diff --git a/src/ssl_sock.c b/src/ssl_sock.c
index 758b029..d0acc80 100644
--- a/src/ssl_sock.c
+++ b/src/ssl_sock.c
@@ -7567,6 +7567,7 @@
int write = -1;
OCSP_RESPONSE *resp;
const unsigned char *p;
+ int retval = -1;
if (!ocsp_response)
return -1;
@@ -7619,13 +7620,13 @@
ist_double_lf = istist(ist_block, double_lf);
}
- b_istput(out, ist_block);
+ retval = (b_istput(out, ist_block) <= 0);
}
if (bio)
BIO_free(bio);
- return 0;
+ return retval;
}
/*
@@ -7656,7 +7657,10 @@
if (trash == NULL)
return 1;
- ssl_ocsp_response_print(&ocsp->response, trash);
+ if (ssl_ocsp_response_print(&ocsp->response, trash)) {
+ free_trash_chunk(trash);
+ return 1;
+ }
if (ci_putchk(si_ic(si), trash) == -1) {
si_rx_room_blk(si);