Commit e04ccbc5 authored by Dr. Stephen Henson's avatar Dr. Stephen Henson
Browse files

Fix two bugs which affect delta CRL handling: 

Use -1 to check all extensions in CRLs.
Always set flag for freshest CRL.
parent bc946bfb

crypto/x509/x509_vfy.c

+2 −2
Original line number Diff line number Diff line
@@ -888,7 +888,7 @@ static int crl_extension_match(X509_CRL *a, X509_CRL *b, int nid) 
	{

	ASN1_OCTET_STRING *exta, *extb;

	int i;

	i = X509_CRL_get_ext_by_NID(a, nid, 0);

	i = X509_CRL_get_ext_by_NID(a, nid, -1);

	if (i >= 0)

		{

		/* Can't have multiple occurrences */
@@ -899,7 +899,7 @@ static int crl_extension_match(X509_CRL *a, X509_CRL *b, int nid) 
	else

		exta = NULL;



	i = X509_CRL_get_ext_by_NID(b, nid, 0);

	i = X509_CRL_get_ext_by_NID(b, nid, -1);



	if (i >= 0)

		{

crypto/x509v3/v3_purp.c

+2 −2
Original line number Diff line number Diff line
@@ -474,11 +474,11 @@ static void x509v3_cache_extensions(X509 *x) 
	for (i = 0; i < X509_get_ext_count(x); i++)

		{

		ex = X509_get_ext(x, i);

		if (!X509_EXTENSION_get_critical(ex))

			continue;

		if (OBJ_obj2nid(X509_EXTENSION_get_object(ex))

					== NID_freshest_crl)

			x->ex_flags |= EXFLAG_FRESHEST;

		if (!X509_EXTENSION_get_critical(ex))

			continue;

		if (!X509_supported_extension(ex))

			{

			x->ex_flags |= EXFLAG_CRITICAL;