Commit d9793261 authored by Kyle Nekritz's avatar Kyle Nekritz Committed by Facebook Github Bot

Clear OpenSSL error stack after loading certificate file.

Summary: SSL_CTX_load_verify_locations interally end up using X509_load_cert_crt_file, which has an unchecked call to X509_STORE_add_cert. This can fail and add an error to the error stack without causing SSL_CTX_load_verify_locations to return an error.

Reviewed By: siyengar

Differential Revision: D4442017

fbshipit-source-id: a4cf7f5ee2c18d90d5d61baf3acb99ffca6b8af0
parent b9591985
...@@ -342,6 +342,7 @@ void SSLContext::loadTrustedCertificates(const char* path) { ...@@ -342,6 +342,7 @@ void SSLContext::loadTrustedCertificates(const char* path) {
if (SSL_CTX_load_verify_locations(ctx_, path, nullptr) == 0) { if (SSL_CTX_load_verify_locations(ctx_, path, nullptr) == 0) {
throw std::runtime_error("SSL_CTX_load_verify_locations: " + getErrors()); throw std::runtime_error("SSL_CTX_load_verify_locations: " + getErrors());
} }
ERR_clear_error();
} }
void SSLContext::loadTrustedCertificates(X509_STORE* store) { void SSLContext::loadTrustedCertificates(X509_STORE* store) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment