Fix verify algorithm.
authorDr. Stephen Henson <steve@openssl.org>
Tue, 24 Mar 2015 16:21:21 +0000 (16:21 +0000)
committerMatt Caswell <matt@openssl.org>
Mon, 20 Apr 2015 12:42:17 +0000 (13:42 +0100)
commit47daa155a31b0a54ce09ad2ed4d55fad74096dab
tree977bb80b5b67f19675eb782a8adfbc22a7fa32dc
parentbe856c0391d65c8c179721ffa8f35374fddf5892
Fix verify algorithm.

Disable loop checking when we retry verification with an alternative path.
This fixes the case where an intermediate CA is explicitly trusted and part
of the untrusted certificate list. By disabling loop checking for this case
the untrusted CA can be replaced by the explicitly trusted case and
verification will succeed.

Signed-off-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit e5991ec528b1c339062440811e2641f5ea2b328b)

Reviewed-by: Rich Salz <rsalz@openssl.org>
crypto/x509/x509_vfy.c