From: Dr. Stephen Henson <steve@openssl.org>
Date: Sun, 19 Feb 2017 21:16:46 +0000 (+0000)
Subject: Check validity, not just signing for all certificates
X-Git-Tag: OpenSSL_1_1_1-pre1~2326
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=38e8f3cd815f86b80d54892bb40ba67ab9fb83bd;p=oweals%2Fopenssl.git

Check validity, not just signing for all certificates

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2679)
---

diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c
index 48c37b8217..dea2dac05b 100644
--- a/ssl/ssl_lib.c
+++ b/ssl/ssl_lib.c
@@ -2768,8 +2768,8 @@ void ssl_set_masks(SSL *s)
 #endif
 
     rsa_enc = pvalid[SSL_PKEY_RSA] & CERT_PKEY_VALID;
-    rsa_sign = pvalid[SSL_PKEY_RSA] & CERT_PKEY_SIGN;
-    dsa_sign = pvalid[SSL_PKEY_DSA_SIGN] & CERT_PKEY_SIGN;
+    rsa_sign = pvalid[SSL_PKEY_RSA] & CERT_PKEY_VALID;
+    dsa_sign = pvalid[SSL_PKEY_DSA_SIGN] & CERT_PKEY_VALID;
 #ifndef OPENSSL_NO_EC
     have_ecc_cert = pvalid[SSL_PKEY_ECC] & CERT_PKEY_VALID;
 #endif