diff --git a/src/ocsp.c b/src/ocsp.c index 2d49b0dcbd2..62672274624 100644 --- a/src/ocsp.c +++ b/src/ocsp.c @@ -2110,44 +2110,49 @@ int wolfSSL_OCSP_id_get0_info(WOLFSSL_ASN1_STRING **name, /* build up ASN1_INTEGER for serial */ if (serial != NULL) { - int i = 0; - WOLFSSL_ASN1_INTEGER* ser; - - ser = wolfSSL_ASN1_INTEGER_new(); - if (ser == NULL) - return 0; + if (cid->status->serialInt != NULL) { + *serial = cid->status->serialInt; + } else { + int i = 0; + WOLFSSL_ASN1_INTEGER* ser; - if (cid->status->serialSz > (WOLFSSL_ASN1_INTEGER_MAX - 2)) { - /* allocate data buffer, +2 for type and length */ - ser->data = (unsigned char*)XMALLOC((size_t)cid->status->serialSz + 2, NULL, - DYNAMIC_TYPE_OPENSSL); - if (ser->data == NULL) { - wolfSSL_ASN1_INTEGER_free(ser); + ser = wolfSSL_ASN1_INTEGER_new(); + if (ser == NULL) return 0; + + if (cid->status->serialSz > (WOLFSSL_ASN1_INTEGER_MAX - 2)) { + /* allocate data buffer, +2 for type and length */ + ser->data = (unsigned char*)XMALLOC( + (size_t)cid->status->serialSz + 2, NULL, + DYNAMIC_TYPE_OPENSSL); + if (ser->data == NULL) { + wolfSSL_ASN1_INTEGER_free(ser); + return 0; + } + ser->dataMax = (unsigned int)cid->status->serialSz + 2; + ser->isDynamic = 1; + } else { + /* Use array instead of dynamic memory */ + ser->data = ser->intData; + ser->dataMax = WOLFSSL_ASN1_INTEGER_MAX; } - ser->dataMax = (unsigned int)cid->status->serialSz + 2; - ser->isDynamic = 1; - } else { - /* Use array instead of dynamic memory */ - ser->data = ser->intData; - ser->dataMax = WOLFSSL_ASN1_INTEGER_MAX; - } - #if defined(WOLFSSL_QT) || defined(WOLFSSL_HAPROXY) - /* Serial number starts at 0 index of ser->data */ - XMEMCPY(&ser->data[i], cid->status->serial, - (size_t)cid->status->serialSz); - ser->length = cid->status->serialSz; - #else - ser->data[i++] = ASN_INTEGER; - i += SetLength(cid->status->serialSz, ser->data + i); - XMEMCPY(&ser->data[i], cid->status->serial, - (size_t)cid->status->serialSz); - ser->length = i + cid->status->serialSz; - #endif - - cid->status->serialInt = ser; - *serial = ser; + #if defined(WOLFSSL_QT) || defined(WOLFSSL_HAPROXY) + /* Serial number starts at 0 index of ser->data */ + XMEMCPY(&ser->data[i], cid->status->serial, + (size_t)cid->status->serialSz); + ser->length = cid->status->serialSz; + #else + ser->data[i++] = ASN_INTEGER; + i += SetLength(cid->status->serialSz, ser->data + i); + XMEMCPY(&ser->data[i], cid->status->serial, + (size_t)cid->status->serialSz); + ser->length = i + cid->status->serialSz; + #endif + + cid->status->serialInt = ser; + *serial = ser; + } } /* Not needed for Apache, return error if user is requesting */ diff --git a/tests/api.c b/tests/api.c index be5c1267a4c..f99196a4d51 100644 --- a/tests/api.c +++ b/tests/api.c @@ -27158,6 +27158,7 @@ static int test_wolfSSL_OCSP_id_get0_info(void) ASN1_OBJECT* pmd = NULL; ASN1_STRING* keyHash = NULL; ASN1_INTEGER* serial = NULL; + ASN1_INTEGER* serial2 = NULL; ASN1_INTEGER* x509Int = NULL; ExpectNotNull(cert = wolfSSL_X509_load_certificate_file(svrCertFile, @@ -27178,6 +27179,9 @@ static int test_wolfSSL_OCSP_id_get0_info(void) ExpectIntEQ(OCSP_id_get0_info(NULL, NULL, NULL, &serial, id), 1); ExpectNotNull(serial); + /* A second call must return the cached serial, not allocate a new one. */ + ExpectIntEQ(OCSP_id_get0_info(NULL, NULL, NULL, &serial2, id), 1); + ExpectPtrEq(serial, serial2); /* compare serial number to one in cert, should be equal */ ExpectNotNull(x509Int = X509_get_serialNumber(cert));