From f217b5e6f21056be4d7cbdf552c86d40007dc2b0 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Sat, 23 Sep 2017 10:59:58 +0200 Subject: ocsptool: check chain size on verification Signed-off-by: Nikos Mavrogiannopoulos --- src/ocsptool.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/ocsptool.c b/src/ocsptool.c index c0ae7ad6fe..1338d6122b 100644 --- a/src/ocsptool.c +++ b/src/ocsptool.c @@ -478,8 +478,12 @@ static void verify_response(gnutls_datum_t *nonce) if (HAVE_OPT(LOAD_CHAIN)) { chain_size = load_chain(chain); + if (chain_size < 1) { + fprintf(stderr, "Empty chain found; cannot verify\n"); + app_exit(1); + } - if (chain_size <= 1) + if (chain_size == 1) signer = chain[0]; else signer = chain[1]; -- cgit v1.2.1