From 8b16ea4ecb70d4182a4bcde733e1d64267f9c488 Mon Sep 17 00:00:00 2001
From: tb <>
Date: Wed, 29 Jun 2022 21:16:30 +0000
Subject: Add a security check to ssl_set_cert()

ok beck jsing
---
 src/lib/libssl/ssl_rsa.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/src/lib/libssl/ssl_rsa.c b/src/lib/libssl/ssl_rsa.c
index 11edb6f76e..11296d3baa 100644
--- a/src/lib/libssl/ssl_rsa.c
+++ b/src/lib/libssl/ssl_rsa.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_rsa.c,v 1.41 2022/06/29 21:13:34 tb Exp $ */
+/* $OpenBSD: ssl_rsa.c,v 1.42 2022/06/29 21:16:30 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -364,8 +364,14 @@ ssl_set_cert(SSL_CTX *ctx, SSL *ssl, X509 *x)
 {
 	SSL_CERT *c;
 	EVP_PKEY *pkey;
+	int ssl_err;
 	int i;
 
+	if (!ssl_security_cert(ctx, ssl, x, 1, &ssl_err)) {
+		SSLerrorx(ssl_err);
+		return (0);
+	}
+
 	if ((c = ssl_get0_cert(ctx, ssl)) == NULL)
 		return (0);
 
-- 
cgit v1.2.3-55-g6feb