2 ms·
I don't see how it could. If they had a test that X509_V_FLAG_X509_STRICT carried out the intended additional checks, and a test that non-CA certificates could
by makomk 6y ago
I don't see how it could. If they had a test that X509_V_FLAG_X509_STRICT carried out the intended additional checks, and a test that non-CA certificates could not issue other certificates, and a test that valid certificate chains were accepted, wouldn't that cover all the branches involved without ever detecting the particular problematic combination involved in this bug?
- jeffbee 6y agoI dunno, at least the new release slightly uh, changes?, the coverage. ~/openssl-1.1.1i % gcov crypto/x509/x509_vfy.c -bm File 'crypto/x509/x509_vfy.c' Lines executed:63.20% of 1625 Branches executed:73.70% of 1194 Taken at least once:53.85% of 1194 Calls executed:58.47% of 496 Creating 'x509_vfy.c.gcov' ~/openssl-1.1.1k % gcov crypto/x509/x509_vfy.c -bm File 'crypto/x509/x509_vfy.c' Lines executed:63.21% of 1628 Branches executed:73.75% of 1196 Taken at least once:53.93% of 1196 Calls executed:58.47% of 496 Creating 'x509_vfy.c.gcov' There are still hundreds of never-taken branches in this file alone. ~/openssl-1.1.1k % grep -c never\ executed x509_vfy.c.gcov 520