Commit 3ade92e7 authored by Rich Salz's avatar Rich Salz
Browse files

Correctly find all critical CRL extensions 



Unhandled critical CRL extensions were not detected if they appeared
after the handled ones.  (GitHub issue 1757).  Thanks to John Chuah
for reporting this.

Reviewed-by: default avatarRichard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1769)
parent 45f4761f

crypto/asn1/x_crl.c

+2 −1
Original line number Diff line number Diff line
@@ -254,6 +254,7 @@ static int crl_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it, 


        for (idx = 0; idx < sk_X509_EXTENSION_num(exts); idx++) {

            int nid;



            ext = sk_X509_EXTENSION_value(exts, idx);

            nid = OBJ_obj2nid(ext->object);

            if (nid == NID_freshest_crl)
@@ -263,7 +264,7 @@ static int crl_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it, 
                if ((nid == NID_issuing_distribution_point)

                    || (nid == NID_authority_key_identifier)

                    || (nid == NID_delta_crl))

                    break;;

                    continue;

                crl->flags |= EXFLAG_CRITICAL;

                break;

            }