diff options
| author | Dr. Stephen Henson <steve@openssl.org> | 2016-07-29 17:54:52 +0100 |
|---|---|---|
| committer | Dr. Stephen Henson <steve@openssl.org> | 2016-07-29 18:49:12 +0100 |
| commit | 3dc160e9be6dcaeec9345fbb61b1c427d7026103 (patch) | |
| tree | e4cf142537eb1c198e18c2ad102d2a5b337397d0 /crypto/x509 | |
| parent | cdddc96d5defb418457b91817650971311816298 (diff) | |
Fix CRL time comparison.
Thanks to David Benjamin <davidben@google.com> for reporting this bug.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit e032117db251968bd09badc7d4718c2497302e55)
Diffstat (limited to 'crypto/x509')
| -rw-r--r-- | crypto/x509/x509_vfy.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c index 5873ad4c63..ade5985db5 100644 --- a/crypto/x509/x509_vfy.c +++ b/crypto/x509/x509_vfy.c @@ -1130,7 +1130,11 @@ static int get_crl_sk(X509_STORE_CTX *ctx, X509_CRL **pcrl, X509_CRL **pdcrl, if (ASN1_TIME_diff(&day, &sec, X509_CRL_get_lastUpdate(best_crl), X509_CRL_get_lastUpdate(crl)) == 0) continue; - if (day < 0 || sec <= 0) + /* + * ASN1_TIME_diff never returns inconsistent signs for |day| + * and |sec|. + */ + if (day <= 0 && sec <= 0) continue; } best_crl = crl; |