From 0c2c2e71a6ac5be7884996938aa31e1f9fe76e55 Mon Sep 17 00:00:00 2001 From: "Dr. Stephen Henson" Date: Fri, 23 Oct 2009 12:05:54 +0000 Subject: [PATCH] If not checking all certificates don't attempt to find a CRL for the leaf certificate of a CRL path. --- crypto/x509/x509_vfy.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c index d1a15502a2..f5f632a45d 100644 --- a/crypto/x509/x509_vfy.c +++ b/crypto/x509/x509_vfy.c @@ -679,7 +679,12 @@ static int check_revocation(X509_STORE_CTX *ctx) if (ctx->param->flags & X509_V_FLAG_CRL_CHECK_ALL) last = sk_X509_num(ctx->chain) - 1; else + { + /* If checking CRL paths this isn't the EE certificate */ + if (ctx->parent) + return 1; last = 0; + } for(i = 0; i <= last; i++) { ctx->error_depth = i; -- 2.25.1