cve-2026-42327漏洞修复

Signed-off-by: ljy9810 <longjianyin@h-partners.com>

openssl/src/error.rs

@@ -54,6 +54,10 @@ impl ErrorStack {
             error.put();
         }
     }
+
+    pub(crate) fn internal_error(message: &'static str) -> ErrorStack {
+        ErrorStack(vec![Error::new_internal(message)])
+    }
 }
 
 impl ErrorStack {
@@ -160,6 +164,21 @@ impl Error {
         }
     }
 
+    pub(crate) fn new_internal(message: &'static str) -> Error {
+        unsafe {
+            Error {
+                code: 0,
+                file: ShimStr::new(
+                    CStr::from_bytes_with_nul_unchecked(b"<rust-openssl>\0")
+                        .as_ptr(),
+                ),
+                line: 0,
+                func: None,
+                data: Some(Cow::Borrowed(message)),
+            }
+        }
+    }
+
     /// Pushes the error back onto the OpenSSL error stack.
     pub fn put(&self) {
         self.put_error();

openssl/src/x509/mod.rs

@@ -600,9 +600,24 @@ impl X509Ref {
 
     /// Returns the list of OCSP responder URLs specified in the certificate's Authority Information
     /// Access field.
+    ///
+    /// Returns an error if any URL contains bytes that are not valid UTF-8, since OpenSSL
+    /// does not enforce that the underlying `IA5String` is ASCII.
     #[corresponds(X509_get1_ocsp)]
     pub fn ocsp_responders(&self) -> Result<Stack<OpensslString>, ErrorStack> {
-        unsafe { cvt_p(ffi::X509_get1_ocsp(self.as_ptr())).map(|p| Stack::from_ptr(p)) }
+        unsafe {
+            let stack: Stack<OpensslString> =
+                cvt_p(ffi::X509_get1_ocsp(self.as_ptr())).map(|p| Stack::from_ptr(p))?;
+            for entry in &stack {
+                let bytes = CStr::from_ptr(entry.as_ptr()).to_bytes();
+                if str::from_utf8(bytes).is_err() {
+                    return Err(ErrorStack::internal_error(
+                        "OCSP responder URL contained invalid UTF-8",
+                    ));
+                }
+            }
+            Ok(stack)
+        }
     }
 
     /// Checks that this certificate issued `subject`.

openssl/src/x509/tests.rs

@@ -1196,3 +1196,10 @@ fn test_store_all_certificates() {
 
     assert_eq!(store.all_certificates().len(), 1);
 }
+
+#[test]
+fn test_ocsp_responders_invalid_utf8() {
+    let cert = include_bytes!("../../test/aia_bad_utf8_cert.pem");
+    let cert = X509::from_pem(cert).unwrap();
+    assert!(cert.ocsp_responders().is_err());
+}

openssl/test/aia_bad_utf8_cert.pem

@@ -0,0 +1,17 @@
+-----BEGIN CERTIFICATE-----
+MIICxDCCAaygAwIBAgIBATANBgkqhkiG9w0BAQsFADAPMQ0wCwYDVQQDDAR0ZXN0
+MB4XDTI1MDEwMTAwMDAwMFoXDTMwMDEwMTAwMDAwMFowDzENMAsGA1UEAwwEdGVz
+dDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALIEHMo+c8x4XLBG4RoG
+DnCMRRKSINgGS0grer4voTJagySK7WOsb1AKjHF990Qa5xQmJpcwt6zm929CvT3j
+Uz54jbp84fIO1IhGObuXchA2dXcDQ19QPT/YLCfiH0xYuBMyT3/j5VoX9POTEKGY
+zFOvrUuEfM1xuM7W4R4pQsErdWqR8edRDZg+1EoKrWZ253zCB/rTLzjgPxljX18Y
+8KUJVwnrStty4jdgRQ6LHPY62dwo7rXV9JafbUDvfjdBwLnhPaNQ91zO15uvBJ5I
+9UTwRuJhoumrkcBtTgmPkHn8Vgk4ZRa/1MFIMcIW3Q9ZomuBfRRdyLzz5dvzCIGL
+nIcCAwEAAaMrMCkwJwYIKwYBBQUHAQEEGzAZMBcGCCsGAQUFBzABhgtodHRwOi8v
+YS/AwDANBgkqhkiG9w0BAQsFAAOCAQEAe77oEyXXuiVdycGRahnMHDBd3sBI64It
+V20+pPxyTLAgvwbYWlP4fHEFCsOppNpGbzq780JJqgwdn1lELfKle+iaQGfXy/Ju
+Hr6/XcDd9T9ZoycoHCF5D63FkI7eMiB+j+6hxL93D3grSgDlqEfLqbtsgV3HjLpv
+/mJTlcHD3yyd/5zQdeGpmumOJxNAG6kxYj8UWjG+Dcu/VIESUjmBqSNVvd/Z/LM6
+xkwyCTBbTH1FS7Pmn1yEhVcPe1vMoIRXKzhK8qPg99JmkFtY0HU3vVdGAiT0hsai
+9VVmX8ZzLxiBHBWA0/j8FwnxEINeJjAEvNV3z70mYn2nyNBe0B5W+w==
+-----END CERTIFICATE-----