Fix indent issue with functions using STACK_OF

[oweals/openssl.git] / crypto / x509 / x509_lu.c

diff --git a/crypto/x509/x509_lu.c b/crypto/x509/x509_lu.c
index cce90848a260a6f1c3d38421d92ea94ccdbee6bd..ec75035ce345952a9b6db18927e29f86d3a9d4c7 100644 (file)
--- a/crypto/x509/x509_lu.c
+++ b/crypto/x509/x509_lu.c
@@ -61,6 +61,7 @@
 #include <openssl/lhash.h>
 #include <openssl/x509.h>
 #include <openssl/x509v3.h>
+#include "x509_lcl.h"
 
 X509_LOOKUP *X509_LOOKUP_new(X509_LOOKUP_METHOD *method)
        {
@@ -333,7 +334,7 @@ int X509_STORE_get_by_subject(X509_STORE_CTX *vs, int type, X509_NAME *name,
                        return 0;
                }
 
-/*     if (ret->data.ptr != NULL)
+/*-    if (ret->data.ptr != NULL)
                X509_OBJECT_free_contents(ret); */
 
        ret->type=tmp->type;
@@ -498,7 +499,7 @@ X509_OBJECT *X509_OBJECT_retrieve_by_subject(STACK_OF(X509_OBJECT) *h, int type,
        return sk_X509_OBJECT_value(h, idx);
        }
 
-STACK_OF(X509)* X509_STORE_get1_certs(X509_STORE_CTX *ctx, X509_NAME *nm)
+STACK_OF(X509) *X509_STORE_get1_certs(X509_STORE_CTX *ctx, X509_NAME *nm)
        {
        int i, idx, cnt;
        STACK_OF(X509) *sk;
@@ -547,7 +548,7 @@ STACK_OF(X509)* X509_STORE_get1_certs(X509_STORE_CTX *ctx, X509_NAME *nm)
 
        }
 
-STACK_OF(X509_CRL)* X509_STORE_get1_crls(X509_STORE_CTX *ctx, X509_NAME *nm)
+STACK_OF(X509_CRL) *X509_STORE_get1_crls(X509_STORE_CTX *ctx, X509_NAME *nm)
        {
        int i, idx, cnt;
        STACK_OF(X509_CRL) *sk;
@@ -623,7 +624,8 @@ X509_OBJECT *X509_OBJECT_retrieve_match(STACK_OF(X509_OBJECT) *h, X509_OBJECT *x
        }
 
 
-/* Try to get issuer certificate from store. Due to limitations
+/*-
+ * Try to get issuer certificate from store. Due to limitations
  * of the API this can only retrieve a single certificate matching
  * a given subject name. However it will fill the cache with all
  * matching certificates, so we can examine the cache for all
@@ -639,6 +641,7 @@ int X509_STORE_CTX_get1_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *x)
        X509_NAME *xn;
        X509_OBJECT obj, *pobj;
        int i, ok, idx, ret;
+       *issuer = NULL;
        xn=X509_get_issuer_name(x);
        ok=X509_STORE_get_by_subject(ctx,X509_LU_X509,xn,&obj);
        if (ok != X509_LU_X509)
@@ -660,8 +663,11 @@ int X509_STORE_CTX_get1_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *x)
        /* If certificate matches all OK */
        if (ctx->check_issued(ctx, x, obj.data.x509))
                {
-               *issuer = obj.data.x509;
-               return 1;
+               if (x509_check_cert_time(ctx, obj.data.x509, 1))
+                       {
+                       *issuer = obj.data.x509;
+                       return 1;
+                       }
                }
        X509_OBJECT_free_contents(&obj);
 
@@ -683,13 +689,22 @@ int X509_STORE_CTX_get1_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *x)
                        if (ctx->check_issued(ctx, x, pobj->data.x509))
                                {
                                *issuer = pobj->data.x509;
-                               X509_OBJECT_up_ref_count(pobj);
                                ret = 1;
-                               break;
+                               /*
+                                * If times check, exit with match,
+                                * otherwise keep looking. Leave last
+                                * match in issuer so we return nearest
+                                * match if no certificate time is OK.
+                                */
+
+                               if (x509_check_cert_time(ctx, *issuer, 1))
+                                       break;
                                }
                        }
                }
        CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
+       if (*issuer)
+               CRYPTO_add(&(*issuer)->references,1,CRYPTO_LOCK_X509);
        return ret;
        }