Commit 783555d8e11516fdc01b66da0f873f5854b9bff6
2014-04-26T14:36:32
netops: catch the server not sending a certificate It's possible for an encrypted connection not have a certificate. In this case, SSL_get_verify_result() will return OK because no error happened (as it never even tried to validate anything). SSL_get_peer_certificate() will return NULL in this case so we need to catch that. On the upside, the current code would segfault in this situation instead of letting it through as a valid cert.
diff --git a/src/netops.c b/src/netops.c
index 1e18321..24092c1 100644
--- a/src/netops.c
+++ b/src/netops.c
@@ -287,6 +287,10 @@ static int verify_server_cert(gitno_ssl *ssl, const char *host)
cert = SSL_get_peer_certificate(ssl->ssl);
+ if (!cert) {
+ giterr_set(GITERR_SSL, "the server did not provide a certificate");
+ return -1;
+ }
/* Check the alternative names */
alts = X509_get_ext_d2i(cert, NID_subject_alt_name, NULL, NULL);