From: Viktor Dukhovni <openssl-users@dukhovni.org>
Date: Thu, 14 Jan 2016 20:03:15 +0000 (-0500)
Subject: Cosmetic polish for last-resort depth 0 check
X-Git-Tag: OpenSSL_1_1_0-pre3~525
X-Git-Url: https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff_plain;h=497ecc0d7d1221ae339aad62d2728c66f6ec816a

Cosmetic polish for last-resort depth 0 check

Reviewed-by: Rich Salz <rsalz@openssl.org>
---

diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c
index 24ca9e347d..972760c4d0 100644
--- a/crypto/x509/x509_vfy.c
+++ b/crypto/x509/x509_vfy.c
@@ -618,7 +618,7 @@ static int check_trust(X509_STORE_CTX *ctx, int num_untrusted)
         return X509_TRUST_UNTRUSTED;
     }
 
-    if (num_untrusted > num && ctx->param->flags & X509_V_FLAG_PARTIAL_CHAIN) {
+    if (num_untrusted == num && ctx->param->flags & X509_V_FLAG_PARTIAL_CHAIN) {
         /*
          * Last-resort call with no new trusted certificates, check the leaf
          * for a direct trust store match.
@@ -2894,12 +2894,12 @@ static int build_chain(X509_STORE_CTX *ctx)
      * Last chance to make a trusted chain, either bare DANE-TA public-key
      * signers, or else direct leaf PKIX trust.
      */
-    if (sk_X509_num(ctx->chain) <= depth) {
+    num = sk_X509_num(ctx->chain);
+    if (num <= depth) {
         if (trust == X509_TRUST_UNTRUSTED && DANETLS_HAS_DANE_TA(dane))
             trust = check_dane_pkeys(ctx);
-        if (trust == X509_TRUST_UNTRUSTED &&
-            sk_X509_num(ctx->chain) == ctx->num_untrusted)
-            trust = check_trust(ctx, ctx->num_untrusted+1);
+        if (trust == X509_TRUST_UNTRUSTED && num == ctx->num_untrusted)
+            trust = check_trust(ctx, num);
     }
 
     switch (trust) {