From: Dr. Stephen Henson <steve@openssl.org>
Date: Fri, 29 Jul 2016 16:54:52 +0000 (+0100)
Subject: Fix CRL time comparison.
X-Git-Tag: OpenSSL_1_0_2i~99
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=3dc160e9be6dcaeec9345fbb61b1c427d7026103;p=oweals%2Fopenssl.git

Fix CRL time comparison.

Thanks to David Benjamin <davidben@google.com> for reporting this bug.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit e032117db251968bd09badc7d4718c2497302e55)
---

diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c
index 5873ad4c63..ade5985db5 100644
--- a/crypto/x509/x509_vfy.c
+++ b/crypto/x509/x509_vfy.c
@@ -1130,7 +1130,11 @@ static int get_crl_sk(X509_STORE_CTX *ctx, X509_CRL **pcrl, X509_CRL **pdcrl,
             if (ASN1_TIME_diff(&day, &sec, X509_CRL_get_lastUpdate(best_crl),
                                X509_CRL_get_lastUpdate(crl)) == 0)
                 continue;
-            if (day < 0 || sec <= 0)
+            /*
+             * ASN1_TIME_diff never returns inconsistent signs for |day|
+             * and |sec|.
+             */
+            if (day <= 0 && sec <= 0)
                 continue;
         }
         best_crl = crl;