Fix for partial chain notification.
authorDr. Stephen Henson <steve@openssl.org>
Fri, 13 Dec 2013 14:05:32 +0000 (14:05 +0000)
committerDr. Stephen Henson <steve@openssl.org>
Fri, 13 Dec 2013 15:39:55 +0000 (15:39 +0000)
For consistency with other cases if we are performing
partial chain verification with just one certificate
notify the callback with ok==1.
(cherry picked from commit 852553d9005e13aed7feb986a5d71cb885b994c7)

crypto/x509/x509_vfy.c

index eaab347..7d92a5b 100644 (file)
@@ -1753,7 +1753,10 @@ static int internal_verify(X509_STORE_CTX *ctx)
        else
                {
                if (ctx->param->flags & X509_V_FLAG_PARTIAL_CHAIN && n == 0)
-                       return check_cert_time(ctx, xi);
+                       {
+                       xs = xi;
+                       goto check_cert;
+                       }
                if (n <= 0)
                        {
                        ctx->error=X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE;
@@ -1804,6 +1807,7 @@ static int internal_verify(X509_STORE_CTX *ctx)
 
                xs->valid = 1;
 
+               check_cert:
                ok = check_cert_time(ctx, xs);
                if (!ok)
                        goto end;