From: Viktor Dukhovni <openssl-users@dukhovni.org>
Date: Fri, 25 Nov 2016 05:38:04 +0000 (-0500)
Subject: Restore last-resort expired untrusted intermediate issuers
X-Git-Tag: OpenSSL_1_1_1-pre1~2937
X-Git-Url: https://git.openssl.org/?p=openssl.git;a=commitdiff_plain;h=c53f7355b93885d1f12237f94b363ad747f03dad;ds=sidebyside

Restore last-resort expired untrusted intermediate issuers

Reviewed-by: Matt Caswell <matt@openssl.org>
---

diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c
index 9fbef116be..ebc4424005 100644
--- a/crypto/x509/x509_vfy.c
+++ b/crypto/x509/x509_vfy.c
@@ -308,16 +308,17 @@ int X509_verify_cert(X509_STORE_CTX *ctx)
 static X509 *find_issuer(X509_STORE_CTX *ctx, STACK_OF(X509) *sk, X509 *x)
 {
     int i;
+    X509 *issuer, *rv = NULL;
 
     for (i = 0; i < sk_X509_num(sk); i++) {
-        X509 *issuer = sk_X509_value(sk, i);
-
-        if (!ctx->check_issued(ctx, x, issuer))
-            continue;
-        if (x509_check_cert_time(ctx, issuer, -1))
-            return issuer;
+        issuer = sk_X509_value(sk, i);
+        if (ctx->check_issued(ctx, x, issuer)) {
+            rv = issuer;
+            if (x509_check_cert_time(ctx, rv, -1))
+                break;
+        }
     }
-    return NULL;
+    return rv;
 }
 
 /* Given a possible certificate and issuer check them */