From 48345917747a34feea3da2936994a265c7f2ca11 Mon Sep 17 00:00:00 2001 From: Emilia Kasper Date: Mon, 18 Dec 2017 18:41:05 +0100 Subject: [PATCH] X509_cmp_time: only return 1, 0, -1. The behaviour of X509_cmp_time used to be undocumented. The new behaviour, documented in master, is to return only 0, 1, or -1. Make the code in the other branches to adhere to this behaviour too, to reduce confusion. There is nothing to be gained from returning other values. Fixes GH#4954 Reviewed-by: Rich Salz Reviewed-by: Tim Hudson Reviewed-by: Richard Levitte (Merged from https://github.com/openssl/openssl/pull/4955) --- crypto/x509/x509_vfy.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c index 3018c69ae4..b9b36c4ee0 100644 --- a/crypto/x509/x509_vfy.c +++ b/crypto/x509/x509_vfy.c @@ -1865,10 +1865,11 @@ int X509_cmp_time(const ASN1_TIME *ctm, time_t *cmp_time) return 1; } i = strcmp(buff1, buff2); - if (i == 0) /* wait a second then return younger :-) */ - return -1; - else - return i; + /* + * X509_cmp_time comparison is <=. + * The return value 0 is reserved for errors. + */ + return i > 0 ? 1 : -1; } ASN1_TIME *X509_gmtime_adj(ASN1_TIME *s, long adj) -- 2.25.1