From: Dr. Stephen Henson <steve@openssl.org>
Date: Fri, 23 Oct 2009 12:05:54 +0000 (+0000)
Subject: If not checking all certificates don't attempt to find a CRL
X-Git-Tag: OpenSSL_1_0_0-beta4~28
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=0c2c2e71a6ac5be7884996938aa31e1f9fe76e55;p=oweals%2Fopenssl.git

If not checking all certificates don't attempt to find a CRL
for the leaf certificate of a CRL path.
---

diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c
index d1a15502a2..f5f632a45d 100644
--- a/crypto/x509/x509_vfy.c
+++ b/crypto/x509/x509_vfy.c
@@ -679,7 +679,12 @@ static int check_revocation(X509_STORE_CTX *ctx)
 	if (ctx->param->flags & X509_V_FLAG_CRL_CHECK_ALL)
 		last = sk_X509_num(ctx->chain) - 1;
 	else
+		{
+		/* If checking CRL paths this isn't the EE certificate */
+		if (ctx->parent)
+			return 1;
 		last = 0;
+		}
 	for(i = 0; i <= last; i++)
 		{
 		ctx->error_depth = i;