MT#55283 verify "zero" DTLS cert

... instead of "current" if available closes #1771 Change-Id: Id1b742b2446d4d59b3de251a1d1a5dcbed86834a
2 years ago · 8fba68f2c9
parent 6c3e352193
commit 8fba68f2c9
1 changed files with 7 additions and 1 deletions
--- a/daemon/dtls.c
+++ b/daemon/dtls.c
@ -504,7 +504,13 @@ static int verify_callback(int ok, X509_STORE_CTX *store) {

 	if (ps->dtls_cert)
 		X509_free(ps->dtls_cert);
-	ps->dtls_cert = X509_dup(X509_STORE_CTX_get_current_cert(store));
+	ps->dtls_cert = NULL;
+	X509 *cert = X509_STORE_CTX_get0_cert(store);
+	if (!cert)
+		cert = X509_STORE_CTX_get_current_cert(store);
+	if (!cert)
+		return 0;
+	ps->dtls_cert = X509_dup(cert);

 	if (!media->fingerprint.hash_func || !media->fingerprint.digest_len)
 		return 1; /* delay verification */