diff options
| author | Steven Valdez <svaldez@google.com> | 2016-02-25 21:43:49 +0300 |
|---|---|---|
| committer | David Benjamin <davidben@google.com> | 2016-02-25 23:01:07 +0300 |
| commit | b0576889fa4c86a8e9cb7e978e7160904fa2c5b4 (patch) | |
| tree | 1ad4274e2a03cdd4f4c252687fece8e501cfff08 /crypto/x509 | |
| parent | e42da0e4b4a587f30ee5fbb65ce7bb5791a7a5be (diff) | |
Fix missing ok=0 with cert verification.
Also avoid using "i" in X509_cert_verify as a loop counter, trust
outcome and as an error ordinal.
(Imported from upstream's a3baa171053547488475709c7197592c66e427cf)
Change-Id: I492afdbaa5017bcf00a0412033cf99fca3fe9401
Reviewed-on: https://boringssl-review.googlesource.com/7218
Reviewed-by: David Benjamin <davidben@google.com>
Diffstat (limited to 'crypto/x509')
| -rw-r--r-- | crypto/x509/x509_vfy.c | 15 |
1 files changed, 9 insertions, 6 deletions
diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c index 602c8fbc..3a0fd6c1 100644 --- a/crypto/x509/x509_vfy.c +++ b/crypto/x509/x509_vfy.c @@ -268,6 +268,7 @@ int X509_verify_cert(X509_STORE_CTX *ctx) if (xtmp != NULL) { if (!sk_X509_push(ctx->chain, xtmp)) { OPENSSL_PUT_ERROR(X509, ERR_R_MALLOC_FAILURE); + ok = 0; goto end; } X509_up_ref(xtmp); @@ -363,11 +364,13 @@ int X509_verify_cert(X509_STORE_CTX *ctx) } /* we now have our chain, lets check it... */ - i = check_trust(ctx); + int trust = check_trust(ctx); /* If explicitly rejected error */ - if (i == X509_TRUST_REJECTED) + if (trust == X509_TRUST_REJECTED) { + ok = 0; goto end; + } /* * If it's not explicitly trusted then check if there is an alternative * chain that could be used. We only do this if we haven't already @@ -463,10 +466,10 @@ int X509_verify_cert(X509_STORE_CTX *ctx) if (!ok) goto end; - i = X509_chain_check_suiteb(&ctx->error_depth, NULL, ctx->chain, - ctx->param->flags); - if (i != X509_V_OK) { - ctx->error = i; + int err = X509_chain_check_suiteb(&ctx->error_depth, NULL, ctx->chain, + ctx->param->flags); + if (err != X509_V_OK) { + ctx->error = err; ctx->current_cert = sk_X509_value(ctx->chain, ctx->error_depth); ok = cb(0, ctx); if (!ok) |