crypto: clear OpenSSL error queue after calling X509_verify()

Prior to this commit, functions accessing the OpenSSL error queue did not work properly after x509.verify() returned false. PR-URL: #45377 Reviewed-By: James M Snell <[email protected]> Reviewed-By: Tobias Nießen <[email protected]> Reviewed-By: Filip Skokan <[email protected]>
nodejs · Jan 3, 2023 · dae92e7 · dae92e7
1 parent 597c7fc
commit dae92e7
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 0 deletions.
diff --git a/src/crypto/crypto_x509.cc b/src/crypto/crypto_x509.cc
@@ -468,6 +468,8 @@ void X509Certificate::Verify(const FunctionCallbackInfo<Value>& args) {
   ASSIGN_OR_RETURN_UNWRAP(&key, args[0]);
   CHECK_EQ(key->Data()->GetKeyType(), kKeyTypePublic);
 
+  ClearErrorOnReturn clear_error_on_return;
+
   args.GetReturnValue().Set(
       X509_verify(
           cert->get(),

diff --git a/test/parallel/test-crypto-x509.js b/test/parallel/test-crypto-x509.js
@@ -186,6 +186,11 @@ const der = Buffer.from(
     code: 'ERR_INVALID_ARG_VALUE'
   });
 
+  // Confirm failure of X509Certificate:verify() doesn't affect other functions that use OpenSSL.
+  assert(!x509.verify(x509.publicKey));
+  // This call should not throw.
+  createPrivateKey(key);
+
   // X509Certificate can be cloned via MessageChannel/MessagePort
   const mc = new MessageChannel();
   mc.port1.onmessage = common.mustCall(({ data }) => {