diff options
| author | Neil Horman <nhorman@openssl.org> | 2024-01-02 15:48:00 -0500 |
|---|---|---|
| committer | Neil Horman <nhorman@openssl.org> | 2024-01-05 13:20:34 -0500 |
| commit | bac7e687d71b124b09ad6ad3e15be9b38c08a1ba (patch) | |
| tree | fe15c63538aac466ddc1fbfaef32244ee4112b02 /test/recipes | |
| parent | b062a3c552bf283319dede3437598f1747730053 (diff) | |
| download | openssl-bac7e687d71b124b09ad6ad3e15be9b38c08a1ba.tar.gz | |
Validate config options during x509 extension creation
There are several points during x509 extension creation which rely on
configuration options which may have been incorrectly parsed due to
invalid settings. Preform a value check for null in those locations to
avoid various crashes/undefined behaviors
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23183)
Diffstat (limited to 'test/recipes')
| -rw-r--r-- | test/recipes/25-test_x509.t | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/test/recipes/25-test_x509.t b/test/recipes/25-test_x509.t index 9bf011c188..9b11169a98 100644 --- a/test/recipes/25-test_x509.t +++ b/test/recipes/25-test_x509.t @@ -16,7 +16,7 @@ use OpenSSL::Test qw/:DEFAULT srctop_file/; setup("test_x509"); -plan tests => 43; +plan tests => 44; # Prevent MSys2 filename munging for arguments that look like file paths but # aren't @@ -217,6 +217,14 @@ ok(run(app(["openssl", "x509", "-in", $a_cert, "-CA", $ca_cert, # verify issuer is CA ok (get_issuer($a2_cert) =~ /CN=ca.example.com/); +my $in_csr = srctop_file('test', 'certs', 'x509-check.csr'); +my $in_key = srctop_file('test', 'certs', 'x509-check-key.pem'); +my $invextfile = srctop_file('test', 'invalid-x509.cnf'); +# Test that invalid extensions settings fail +ok(!run(app(["openssl", "x509", "-req", "-in", $in_csr, "-signkey", $in_key, + "-out", "/dev/null", "-days", "3650" , "-extensions", "ext", + "-extfile", $invextfile]))); + # Tests for issue #16080 (fixed in 1.1.1o) my $b_key = "b-key.pem"; my $b_csr = "b-cert.csr"; |