From: Matt Caswell <matt@openssl.org>
Date: Tue, 23 Jun 2015 23:12:38 +0000 (+0100)
Subject: Fix alt chains bug
X-Git-Tag: OpenSSL_1_0_1p~2
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=cb22d2ae5a5b6069dbf66dbcce07223ac15a16de;p=oweals%2Fopenssl.git

Fix alt chains bug

This is a follow up to the alternate chains certificate forgery issue
(CVE-2015-1793). That issue is exacerbated in 1.0.1 by a related bug which
means that we *always* check for an alternative chain, even if we have
already found a chain. The code is supposed to stop as soon as it has found
one (and does do in master and 1.0.2).

Reviewed-by: Stephen Henson <steve@openssl.org>
---

diff --git a/crypto/x509/verify_extra_test.c b/crypto/x509/verify_extra_test.c
index 08509f0131..a1e41f2822 100644
--- a/crypto/x509/verify_extra_test.c
+++ b/crypto/x509/verify_extra_test.c
@@ -168,7 +168,8 @@ static int test_alt_chains_cert_forgery(void)
 
     i = X509_verify_cert(sctx);
 
-    if(i == 0 && X509_STORE_CTX_get_error(sctx) == X509_V_ERR_INVALID_CA) {
+    if(i == 0 && X509_STORE_CTX_get_error(sctx)
+                 == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT) {
         /* This is the result we were expecting: Test passed */
         ret = 1;
     }
diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c
index 2e4c54b816..7009ae6307 100644
--- a/crypto/x509/x509_vfy.c
+++ b/crypto/x509/x509_vfy.c
@@ -312,7 +312,7 @@ int X509_verify_cert(X509_STORE_CTX *ctx)
          * if the user hasn't switched off alternate chain checking
          */
         retry = 0;
-        if (j == ctx->last_untrusted &&
+        if (num == ctx->last_untrusted &&
             !(ctx->param->flags & X509_V_FLAG_NO_ALT_CHAINS)) {
             while (j-- > 1) {
                 xtmp2 = sk_X509_value(ctx->chain, j - 1);