diff options
| author | Dr. Stephen Henson <steve@openssl.org> | 2016-07-29 17:54:52 +0100 |
|---|---|---|
| committer | Dr. Stephen Henson <steve@openssl.org> | 2016-07-29 18:47:57 +0100 |
| commit | e032117db251968bd09badc7d4718c2497302e55 (patch) | |
| tree | 8e4895030c93ddf792cda1ea73781c8af55e3010 /crypto | |
| parent | e040a42e44b40f09ce485f66c9198456a3f8a457 (diff) | |
| download | openssl-e032117db251968bd09badc7d4718c2497302e55.zip openssl-e032117db251968bd09badc7d4718c2497302e55.tar.gz openssl-e032117db251968bd09badc7d4718c2497302e55.tar.bz2 | |
Fix CRL time comparison.
Thanks to David Benjamin <davidben@google.com> for reporting this bug.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Diffstat (limited to 'crypto')
| -rw-r--r-- | crypto/x509/x509_vfy.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c index abe9caa..099a4d8 100644 --- a/crypto/x509/x509_vfy.c +++ b/crypto/x509/x509_vfy.c @@ -979,7 +979,11 @@ static int get_crl_sk(X509_STORE_CTX *ctx, X509_CRL **pcrl, X509_CRL **pdcrl, if (ASN1_TIME_diff(&day, &sec, X509_CRL_get_lastUpdate(best_crl), X509_CRL_get_lastUpdate(crl)) == 0) continue; - if (day < 0 || sec <= 0) + /* + * ASN1_TIME_diff never returns inconsistent signs for |day| + * and |sec|. + */ + if (day <= 0 && sec <= 0) continue; } best_crl = crl; |