https://bugs.openldap.org/show_bug.cgi?id=10578

Issue ID: 10578 Summary: libldap never clears OpenSSL error queue so SSL_get_error() can misreport on OpenSSL <4.0 Product: OpenLDAP Version: 2.7.0 Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: libraries Assignee: bugs@openldap.org Reporter: ondra@mistotebe.net Target Milestone: ---

SSL_get_error() needs the calling thread's error queue to be empty before the SSL_* calls that could have produced one but we never make sure that's the case. SSL_get_error() doesn't actually clear the error from the queue, so if a SSL_* call returns an error on OpenSSL <4.0, it stays around as poison.

This can manifest e.g. as an otherwise healthy connection being suddenly terminated with a reason that doesn't track.

We should just call ERR_clear_error() before every SSL_* call that can set it to get something meaningful back.