Partial path fix.

When verifying a partial path always check to see if the EE certificate is explicitly trusted: the path could contain other untrusted certificates.
openssl · Sep 8, 2013 · 52073b7 · 52073b7
1 parent a6e7d1c
commit 52073b7
Showing 1 changed file with 8 additions and 11 deletions.
diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c
@@ -787,20 +787,17 @@ static int check_trust(X509_STORE_CTX *ctx)
 	 */
 	if (ctx->param->flags & X509_V_FLAG_PARTIAL_CHAIN)
 		{
+		X509 *mx;
 		if (ctx->last_untrusted < sk_X509_num(ctx->chain))
 			return X509_TRUST_TRUSTED;
-		if (sk_X509_num(ctx->chain) == 1)
+		x = sk_X509_value(ctx->chain, 0);
+		mx = lookup_cert_match(ctx, x);
+		if (mx)
 			{
-			X509 *mx;
-			x = sk_X509_value(ctx->chain, 0);
-			mx = lookup_cert_match(ctx, x);
-			if (mx)
-				{
-				(void)sk_X509_set(ctx->chain, 0, mx);
-				X509_free(x);
-				ctx->last_untrusted = 0;
-				return X509_TRUST_TRUSTED;
-				}
+			(void)sk_X509_set(ctx->chain, 0, mx);
+			X509_free(x);
+			ctx->last_untrusted = 0;
+			return X509_TRUST_TRUSTED;
 			}
 		}