Skip to content

fix: unchecked *_set_* calls #1044

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rhenium merged 2 commits into from
Nov 10, 2026
Merged

fix: unchecked *_set_* calls #1044

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
874d905
fix: unchecked *_set_* calls
ndossche Apr 29, 2026
96aa2a0
Fix unchecked OpenSSL calls, part 2
rhenium Nov 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 5 additions & 3 deletions ext/openssl/ossl_cipher.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -304,10 +304,12 @@ ossl_cipher_pkcs5_keyivgen(int argc, VALUE *argv, VALUE self)
rb_raise(rb_eArgError, "iterations must be a positive integer");
digest = NIL_P(vdigest) ? EVP_md5() : ossl_evp_md_fetch(vdigest, &md_holder);
GetCipher(self, ctx);
EVP_BytesToKey(EVP_CIPHER_CTX_cipher(ctx), digest, salt,
(unsigned char *)RSTRING_PTR(vpass), RSTRING_LENINT(vpass), iter, key, iv);
if (!EVP_BytesToKey(EVP_CIPHER_CTX_cipher(ctx), digest, salt,
(unsigned char *)RSTRING_PTR(vpass),
RSTRING_LENINT(vpass), iter, key, iv))
ossl_raise(eCipherError, "EVP_BytesToKey");
if (EVP_CipherInit_ex(ctx, NULL, NULL, key, iv, -1) != 1)
ossl_raise(eCipherError, NULL);
ossl_raise(eCipherError, "EVP_CipherInit_ex");
OPENSSL_cleanse(key, sizeof key);
OPENSSL_cleanse(iv, sizeof iv);

Expand Down
2 changes: 2 additions & 0 deletions ext/openssl/ossl_config.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -451,6 +451,8 @@ Init_ossl_config(void)
* The default system configuration file for OpenSSL.
*/
path = CONF_get1_default_config_file();
if (!path)
rb_raise(rb_eRuntimeError, "CONF_get1_default_config_file failed");
path_str = rb_obj_freeze(ossl_buf2str(path));
rb_define_const(cConfig, "DEFAULT_CONFIG_FILE", path_str);
}
3 changes: 2 additions & 1 deletion ext/openssl/ossl_engine.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -376,7 +376,8 @@ ossl_engine_set_default(VALUE self, VALUE flag)
int f = NUM2INT(flag);

GetEngine(self, e);
ENGINE_set_default(e, f);
if (!ENGINE_set_default(e, f))
ossl_raise(eEngineError, "ENGINE_set_default");

return Qtrue;
}
Expand Down
2 changes: 2 additions & 0 deletions ext/openssl/ossl_ocsp.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -688,6 +688,8 @@ ossl_ocspbres_copy_nonce(VALUE self, VALUE request)
GetOCSPBasicRes(self, bs);
GetOCSPReq(request, req);
ret = OCSP_copy_nonce(bs, req);
if (!ret)
ossl_raise(eOCSPError, "OCSP_copy_nonce");

return INT2NUM(ret);
}
Expand Down
17 changes: 13 additions & 4 deletions ext/openssl/ossl_ssl_session.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -185,9 +185,15 @@ static VALUE ossl_ssl_session_set_time(VALUE self, VALUE time_v)
time_v = rb_funcall(time_v, rb_intern("to_i"), 0);
}
#ifdef HAVE_SSL_SESSION_GET_TIME_EX
SSL_SESSION_set_time_ex(ctx, NUM2TIMET(time_v));
time_t t = NUM2TIMET(time_v);
if (SSL_SESSION_set_time_ex(ctx, t) != t) {
ossl_raise(eSSLSession, "SSL_SESSION_set_time_ex");
}
#else
SSL_SESSION_set_time(ctx, NUM2LONG(time_v));
long t = NUM2LONG(time_v);
if (SSL_SESSION_set_time(ctx, t) != t) {
ossl_raise(eSSLSession, "SSL_SESSION_set_time");
}
#endif
return ossl_ssl_session_get_time(self);
}
Expand All @@ -205,7 +211,9 @@ static VALUE ossl_ssl_session_set_timeout(VALUE self, VALUE time_v)

GetSSLSession(self, ctx);
t = NUM2LONG(time_v);
SSL_SESSION_set_timeout(ctx, t);
if (SSL_SESSION_set_timeout(ctx, t) != 1) {
ossl_raise(eSSLSession, "SSL_SESSION_set_timeout");
}
return ossl_ssl_session_get_timeout(self);
}

Expand Down Expand Up @@ -249,7 +257,8 @@ static VALUE ossl_ssl_session_to_der(VALUE self)

str = rb_str_new(0, len);
p = (unsigned char *)RSTRING_PTR(str);
i2d_SSL_SESSION(ctx, &p);
if (i2d_SSL_SESSION(ctx, &p) <= 0)
ossl_raise(eSSLSession, "i2d_SSL_SESSION");
ossl_str_adjust(str, p);
return str;
}
Expand Down
6 changes: 5 additions & 1 deletion ext/openssl/ossl_ts.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -418,7 +418,9 @@ ossl_ts_req_set_cert_requested(VALUE self, VALUE requested)
TS_REQ *req;

GetTSRequest(self, req);
TS_REQ_set_cert_req(req, RTEST(requested));
if (!TS_REQ_set_cert_req(req, RTEST(requested))) {
ossl_raise(eTimestampError, "TS_REQ_set_cert_req");
}

return requested;
}
Expand Down Expand Up @@ -682,6 +684,8 @@ ossl_ts_resp_get_tsa_certificate(VALUE self)
if (!(p7 = TS_RESP_get_token(resp)))
return Qnil;
ts_info = sk_PKCS7_SIGNER_INFO_value(p7->d.sign->signer_info, 0);
if (!ts_info)
return Qnil;
cert = PKCS7_cert_from_signer_info(p7, ts_info);
if (!cert)
return Qnil;
Expand Down
12 changes: 9 additions & 3 deletions ext/openssl/ossl_x509ext.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -351,7 +351,9 @@ ossl_x509ext_set_critical(VALUE self, VALUE flag)
X509_EXTENSION *ext;

GetX509Ext(self, ext);
X509_EXTENSION_set_critical(ext, RTEST(flag) ? 1 : 0);
if (!X509_EXTENSION_set_critical(ext, RTEST(flag) ? 1 : 0)) {
ossl_raise(eX509ExtError, "X509_EXTENSION_set_critical");
}

return flag;
}
Expand Down Expand Up @@ -382,8 +384,12 @@ ossl_x509ext_get_value(VALUE obj)
GetX509Ext(obj, ext);
if (!(out = BIO_new(BIO_s_mem())))
ossl_raise(eX509ExtError, NULL);
if (!X509V3_EXT_print(out, ext, 0, 0))
ASN1_STRING_print(out, X509_EXTENSION_get_data(ext));
if (!X509V3_EXT_print(out, ext, 0, 0)) {
if (!ASN1_STRING_print(out, X509_EXTENSION_get_data(ext))) {
BIO_free(out);
ossl_raise(eX509ExtError, "ASN1_STRING_print");
}
}
ret = ossl_membio2str(out);

return ret;
Expand Down
16 changes: 12 additions & 4 deletions ext/openssl/ossl_x509store.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -342,7 +342,9 @@ ossl_x509store_set_purpose(VALUE self, VALUE purpose)
int p = NUM2INT(purpose);

GetX509Store(self, store);
X509_STORE_set_purpose(store, p);
if (!X509_STORE_set_purpose(store, p)) {
ossl_raise(eX509StoreError, "X509_STORE_set_purpose");
}

return purpose;
}
Expand All @@ -366,7 +368,9 @@ ossl_x509store_set_trust(VALUE self, VALUE trust)
int t = NUM2INT(trust);

GetX509Store(self, store);
X509_STORE_set_trust(store, t);
if (!X509_STORE_set_trust(store, t)) {
ossl_raise(eX509StoreError, "X509_STORE_set_trust");
}

return trust;
}
Expand Down Expand Up @@ -914,7 +918,9 @@ ossl_x509stctx_set_purpose(VALUE self, VALUE purpose)
int p = NUM2INT(purpose);

GetX509StCtx(self, store);
X509_STORE_CTX_set_purpose(store, p);
if (!X509_STORE_CTX_set_purpose(store, p)) {
ossl_raise(eX509StoreError, "X509_STORE_CTX_set_purpose");
}

return purpose;
}
Expand All @@ -935,7 +941,9 @@ ossl_x509stctx_set_trust(VALUE self, VALUE trust)
int t = NUM2INT(trust);

GetX509StCtx(self, store);
X509_STORE_CTX_set_trust(store, t);
if (!X509_STORE_CTX_set_trust(store, t)) {
ossl_raise(eX509StoreError, "X509_STORE_CTX_set_trust");
}

return trust;
}
Expand Down
Loading