mirror/openssl
2
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2024-11-21 01:15:20 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix verify algorithm.

Browse Source 
Disable loop checking when we retry verification with an alternative path.
This fixes the case where an intermediate CA is explicitly trusted and part
of the untrusted certificate list. By disabling loop checking for this case
the untrusted CA can be replaced by the explicitly trusted case and
verification will succeed.

Reviewed-by: Matt Caswell <matt@openssl.org>
This commit is contained in:
Dr. Stephen Henson 2015-03-24 16:21:21 +00:00
parent 2e43027757
commit e5991ec528
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
crypto/x509/x509_vfy.c
View File

@ -365,8 +365,16 @@ int X509_verify_cert(X509_STORE_CTX *ctx)
&& !(ctx->param->flags & X509_V_FLAG_TRUSTED_FIRST)
&& !(ctx->param->flags & X509_V_FLAG_NO_ALT_CHAINS)) {
while (j-- > 1) {
STACK_OF(X509) *chtmp = ctx->chain;
xtmp2 = sk_X509_value(ctx->chain, j - 1);
/*
* Temporarily set chain to NULL so we don't discount
* duplicates: the same certificate could be an untrusted
* CA found in the trusted store.
*/
ctx->chain = NULL;
ok = ctx->get_issuer(&xtmp, ctx, xtmp2);
ctx->chain = chtmp;
if (ok < 0)
goto end;
/* Check if we found an alternate chain */