aboutsummaryrefslogtreecommitdiff
path: root/apps
diff options
context:
space:
mode:
Diffstat (limited to 'apps')
-rw-r--r--apps/cmp.c18
-rw-r--r--apps/include/cmp_mock_srv.h5
-rw-r--r--apps/lib/app_provider.c3
-rw-r--r--apps/lib/apps.c15
-rw-r--r--apps/lib/cmp_mock_srv.c38
-rw-r--r--apps/lib/win32_init.c3
-rw-r--r--apps/ocsp.c2
-rw-r--r--apps/s_client.c6
-rw-r--r--apps/ts.c4
9 files changed, 75 insertions, 19 deletions
diff --git a/apps/cmp.c b/apps/cmp.c
index f1af0b6c2b42..2fe7c18669bd 100644
--- a/apps/cmp.c
+++ b/apps/cmp.c
@@ -1,5 +1,5 @@
/*
- * Copyright 2007-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2007-2026 The OpenSSL Project Authors. All Rights Reserved.
* Copyright Nokia 2007-2019
* Copyright Siemens AG 2015-2019
*
@@ -1421,7 +1421,10 @@ static int setup_verification_ctx(OSSL_CMP_CTX *ctx)
out_vpm = X509_STORE_get0_param(out_trusted);
X509_VERIFY_PARAM_clear_flags(out_vpm, X509_V_FLAG_USE_CHECK_TIME);
- (void)OSSL_CMP_CTX_set_certConf_cb_arg(ctx, out_trusted);
+ if (!OSSL_CMP_CTX_set_certConf_cb_arg(ctx, out_trusted)) {
+ X509_STORE_free(out_trusted);
+ return 0;
+ }
}
if (opt_disable_confirm)
@@ -3390,6 +3393,12 @@ static void print_keyspec(OSSL_CMP_ATAVS *keySpec)
int paramtype;
const void *param;
+ /* NULL check to prevent dereferencing a NULL pointer when print_keyspec is called */
+ if (alg == NULL) {
+ BIO_puts(mem, "Key algorithm: <absent>\n");
+ break;
+ }
+
X509_ALGOR_get0(&oid, &paramtype, &param, alg);
BIO_printf(mem, "Key algorithm: ");
i2a_ASN1_OBJECT(mem, oid);
@@ -3789,8 +3798,7 @@ int cmp_main(int argc, char **argv)
if (opt_ignore_keyusage)
(void)OSSL_CMP_CTX_set_option(cmp_ctx, OSSL_CMP_OPT_IGNORE_KEYUSAGE, 1);
if (opt_no_cache_extracerts)
- (void)OSSL_CMP_CTX_set_option(cmp_ctx, OSSL_CMP_OPT_NO_CACHE_EXTRACERTS,
- 1);
+ (void)OSSL_CMP_CTX_set_option(cmp_ctx, OSSL_CMP_OPT_NO_CACHE_EXTRACERTS, 1);
if (opt_reqout_only == NULL && (opt_use_mock_srv
#if !defined(OPENSSL_NO_SOCK) && !defined(OPENSSL_NO_HTTP)
@@ -3806,7 +3814,7 @@ int cmp_main(int argc, char **argv)
srv_cmp_ctx = OSSL_CMP_SRV_CTX_get0_cmp_ctx(srv_ctx);
if (!OSSL_CMP_CTX_set_log_cb(srv_cmp_ctx, print_to_bio_err)) {
- CMP_err1("cannot set up error reporting and logging for %s", prog);
+ CMP_err1("cannot set up server-side error reporting and logging for %s", prog);
goto err;
}
OSSL_CMP_CTX_set_log_verbosity(srv_cmp_ctx, opt_verbosity);
diff --git a/apps/include/cmp_mock_srv.h b/apps/include/cmp_mock_srv.h
index 215b95b744aa..a6220cdea21a 100644
--- a/apps/include/cmp_mock_srv.h
+++ b/apps/include/cmp_mock_srv.h
@@ -1,5 +1,5 @@
/*
- * Copyright 2018-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2018-2026 The OpenSSL Project Authors. All Rights Reserved.
* Copyright Siemens AG 2018-2020
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
@@ -19,6 +19,8 @@
OSSL_CMP_SRV_CTX *ossl_cmp_mock_srv_new(OSSL_LIB_CTX *libctx,
const char *propq);
void ossl_cmp_mock_srv_free(OSSL_CMP_SRV_CTX *srv_ctx);
+OSSL_CMP_MSG *ossl_cmp_mock_server_perform(OSSL_CMP_CTX *ctx,
+ const OSSL_CMP_MSG *req);
int ossl_cmp_mock_srv_set1_refCert(OSSL_CMP_SRV_CTX *srv_ctx, X509 *cert);
int ossl_cmp_mock_srv_set1_certOut(OSSL_CMP_SRV_CTX *srv_ctx, X509 *cert);
@@ -34,6 +36,7 @@ int ossl_cmp_mock_srv_set1_oldWithNew(OSSL_CMP_SRV_CTX *srv_ctx, X509 *cert);
int ossl_cmp_mock_srv_set_statusInfo(OSSL_CMP_SRV_CTX *srv_ctx, int status,
int fail_info, const char *text);
int ossl_cmp_mock_srv_set_sendError(OSSL_CMP_SRV_CTX *srv_ctx, int bodytype);
+int ossl_cmp_mock_srv_set_useBadProtection(OSSL_CMP_SRV_CTX *srv_ctx, int bodytype);
int ossl_cmp_mock_srv_set_pollCount(OSSL_CMP_SRV_CTX *srv_ctx, int count);
int ossl_cmp_mock_srv_set_checkAfterTime(OSSL_CMP_SRV_CTX *srv_ctx, int sec);
diff --git a/apps/lib/app_provider.c b/apps/lib/app_provider.c
index 6986ab4c1073..3b66d048ea99 100644
--- a/apps/lib/app_provider.c
+++ b/apps/lib/app_provider.c
@@ -1,5 +1,5 @@
/*
- * Copyright 2020-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2020-2026 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -47,6 +47,7 @@ int app_provider_load(OSSL_LIB_CTX *libctx, const char *provider_name)
app_providers = sk_OSSL_PROVIDER_new_null();
if (app_providers == NULL
|| !sk_OSSL_PROVIDER_push(app_providers, prov)) {
+ OSSL_PROVIDER_unload(prov);
app_providers_cleanup();
return 0;
}
diff --git a/apps/lib/apps.c b/apps/lib/apps.c
index 74644157e5ca..bc2e1c123a75 100644
--- a/apps/lib/apps.c
+++ b/apps/lib/apps.c
@@ -191,8 +191,13 @@ int app_passwd(const char *arg1, const char *arg2, char **pass1, char **pass2)
}
if (arg2 != NULL) {
*pass2 = app_get_pass(arg2, same ? 2 : 0);
- if (*pass2 == NULL)
+ if (*pass2 == NULL) {
+ if (pass1 != NULL) {
+ clear_free(*pass1);
+ *pass1 = NULL;
+ }
return 0;
+ }
} else if (pass2 != NULL) {
*pass2 = NULL;
}
@@ -263,15 +268,15 @@ static char *app_get_pass(const char *arg, int keepbio)
}
} else {
/* argument syntax error; do not reveal too much about arg */
- tmp = strchr(arg, ':');
- if (tmp == NULL || tmp - arg > PASS_SOURCE_SIZE_MAX)
+ const char *arg_ptr = strchr(arg, ':');
+ if (arg_ptr == NULL || arg_ptr - arg > PASS_SOURCE_SIZE_MAX)
BIO_printf(bio_err,
"Invalid password argument, missing ':' within the first %d chars\n",
PASS_SOURCE_SIZE_MAX + 1);
else
BIO_printf(bio_err,
"Invalid password argument, starting with \"%.*s\"\n",
- (int)(tmp - arg + 1), arg);
+ (int)(arg_ptr - arg + 1), arg);
return NULL;
}
}
@@ -2494,7 +2499,7 @@ static STACK_OF(X509_CRL) *crls_http_cb(const X509_STORE_CTX *ctx,
error:
X509_CRL_free(crl);
- sk_X509_CRL_free(crls);
+ sk_X509_CRL_pop_free(crls, X509_CRL_free);
return NULL;
}
diff --git a/apps/lib/cmp_mock_srv.c b/apps/lib/cmp_mock_srv.c
index bf8b06c390bd..cf21e8277887 100644
--- a/apps/lib/cmp_mock_srv.c
+++ b/apps/lib/cmp_mock_srv.c
@@ -1,5 +1,5 @@
/*
- * Copyright 2018-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2018-2026 The OpenSSL Project Authors. All Rights Reserved.
* Copyright Siemens AG 2018-2020
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
@@ -10,6 +10,7 @@
#include "apps.h"
#include "cmp_mock_srv.h"
+#include "../../crypto/cmp/cmp_local.h" /* for access to msg->protection */
#include <openssl/cmp.h>
#include <openssl/err.h>
@@ -28,6 +29,7 @@ typedef struct {
X509 *oldWithNew; /* to return in oldWithNew of rootKeyUpdate */
OSSL_CMP_PKISI *statusOut; /* status for ip/cp/kup/rp msg unless polling */
int sendError; /* send error response on given request type */
+ int useBadProtection; /* use bad protection on given response type */
OSSL_CMP_MSG *req; /* original request message during polling */
int pollCount; /* number of polls before actual cert response */
int curr_pollCount; /* number of polls so far for current request */
@@ -59,6 +61,7 @@ static mock_srv_ctx *mock_srv_ctx_new(void)
goto err;
ctx->sendError = -1;
+ ctx->useBadProtection = -1;
/* all other elements are initialized to 0 or NULL, respectively */
return ctx;
@@ -187,6 +190,19 @@ int ossl_cmp_mock_srv_set_sendError(OSSL_CMP_SRV_CTX *srv_ctx, int bodytype)
return 1;
}
+int ossl_cmp_mock_srv_set_useBadProtection(OSSL_CMP_SRV_CTX *srv_ctx, int bodytype)
+{
+ mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
+
+ if (ctx == NULL) {
+ ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
+ return 0;
+ }
+ /* might check bodytype, but this would require exporting all body types */
+ ctx->useBadProtection = bodytype;
+ return 1;
+}
+
int ossl_cmp_mock_srv_set_pollCount(OSSL_CMP_SRV_CTX *srv_ctx, int count)
{
mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
@@ -591,6 +607,7 @@ static int process_genm(OSSL_CMP_SRV_CTX *srv_ctx,
if (rsp != NULL && sk_OSSL_CMP_ITAV_push(*out, rsp))
return 1;
sk_OSSL_CMP_ITAV_free(*out);
+ OSSL_CMP_ITAV_free(rsp);
return 0;
}
@@ -712,6 +729,25 @@ static int process_pollReq(OSSL_CMP_SRV_CTX *srv_ctx,
return 1;
}
+OSSL_CMP_MSG *ossl_cmp_mock_server_perform(OSSL_CMP_CTX *ctx,
+ const OSSL_CMP_MSG *req)
+{
+ OSSL_CMP_SRV_CTX *srv_ctx = OSSL_CMP_CTX_get_transfer_cb_arg(ctx);
+ OSSL_CMP_MSG *rsp = OSSL_CMP_CTX_server_perform(ctx, req);
+
+ if (srv_ctx != NULL && rsp != NULL) {
+ mock_srv_ctx *mock_ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
+
+ if (mock_ctx != NULL && OSSL_CMP_MSG_get_bodytype(rsp) == mock_ctx->useBadProtection) {
+ ASN1_BIT_STRING *prot = rsp->protection;
+
+ if (prot != NULL && prot->length != 0 && prot->data != NULL)
+ prot->data[0] ^= 0x80; /* flip most significant bit of the first byte */
+ }
+ }
+ return rsp;
+}
+
OSSL_CMP_SRV_CTX *ossl_cmp_mock_srv_new(OSSL_LIB_CTX *libctx, const char *propq)
{
OSSL_CMP_SRV_CTX *srv_ctx = OSSL_CMP_SRV_CTX_new(libctx, propq);
diff --git a/apps/lib/win32_init.c b/apps/lib/win32_init.c
index 824eb676310e..0ea2048283cb 100644
--- a/apps/lib/win32_init.c
+++ b/apps/lib/win32_init.c
@@ -1,5 +1,5 @@
/*
- * Copyright 2016-2020 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2016-2026 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -10,7 +10,6 @@
#include <windows.h>
#include <stdlib.h>
#include <string.h>
-#include <malloc.h>
#if defined(CP_UTF8)
diff --git a/apps/ocsp.c b/apps/ocsp.c
index a9b248d3a198..e2c147ef097c 100644
--- a/apps/ocsp.c
+++ b/apps/ocsp.c
@@ -876,7 +876,7 @@ done_resp:
i = OCSP_basic_verify(bs, verify_other, store, verify_flags);
if (i <= 0 && issuers) {
- i = OCSP_basic_verify(bs, issuers, store, OCSP_TRUSTOTHER);
+ i = OCSP_basic_verify(bs, issuers, store, verify_flags);
if (i > 0)
ERR_clear_error();
}
diff --git a/apps/s_client.c b/apps/s_client.c
index 3625f8fcdc99..d356359a97ef 100644
--- a/apps/s_client.c
+++ b/apps/s_client.c
@@ -3892,7 +3892,11 @@ static void user_data_init(struct user_data_st *user_data, SSL *con, char *buf,
static int user_data_add(struct user_data_st *user_data, size_t i)
{
- if (user_data->buflen != 0 || i > user_data->bufmax)
+ /*
+ * We must allow one byte for a NUL terminator so i must be less than
+ * bufmax
+ */
+ if (user_data->buflen != 0 || i >= user_data->bufmax)
return 0;
user_data->buflen = i;
diff --git a/apps/ts.c b/apps/ts.c
index bd800bfaa322..af355bfc05e8 100644
--- a/apps/ts.c
+++ b/apps/ts.c
@@ -1,5 +1,5 @@
/*
- * Copyright 2006-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2006-2026 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -348,7 +348,7 @@ int ts_main(int argc, char **argv)
if ((in != NULL) && (queryfile != NULL))
goto opthelp;
if (in == NULL) {
- if ((conf == NULL) || (token_in != 0))
+ if (conf == NULL || token_in != 0 || queryfile == NULL)
goto opthelp;
}
ret = !reply_command(conf, section, engine, queryfile,
generated by cgit v1.3 (git 2.53.0) at 2026-07-31 01:09:28 +0000