diff options
| author | Viktor Dukhovni <openssl-users@dukhovni.org> | 2016-01-31 21:14:51 -0500 |
|---|---|---|
| committer | Viktor Dukhovni <openssl-users@dukhovni.org> | 2016-02-05 11:13:11 -0500 |
| commit | 895c2f84a6a083fc8b9f69f962ed19da12ce3b40 (patch) | |
| tree | 2b338ff7dc3044f48040efe9f77af3ac5bd9c1e5 /crypto/x509 | |
| parent | a0474357743b5cc4db1b5428ac3db85b1168d3a9 (diff) | |
Long overdue cleanup of X509 policy tree verification
Replace all magic numbers with #defined constants except in boolean
functions that return 0 for failure and 1 for success. Avoid a
couple memory leaks in error recovery code paths. Code style
improvements.
Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
Diffstat (limited to 'crypto/x509')
| -rw-r--r-- | crypto/x509/x509_vfy.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c index 1f3b2b9dab..3438692e57 100644 --- a/crypto/x509/x509_vfy.c +++ b/crypto/x509/x509_vfy.c @@ -1505,12 +1505,12 @@ static int check_policy(X509_STORE_CTX *ctx) return 1; ret = X509_policy_check(&ctx->tree, &ctx->explicit_policy, ctx->chain, ctx->param->policies, ctx->param->flags); - if (ret == 0) { + if (ret == X509_PCY_TREE_INTERNAL) { X509err(X509_F_CHECK_POLICY, ERR_R_MALLOC_FAILURE); return 0; } /* Invalid or inconsistent extensions */ - if (ret == -1) { + if (ret == X509_PCY_TREE_INVALID) { /* * Locate certificates with bad extensions and notify callback. */ @@ -1527,11 +1527,15 @@ static int check_policy(X509_STORE_CTX *ctx) } return 1; } - if (ret == -2) { + if (ret == X509_PCY_TREE_FAILURE) { ctx->current_cert = NULL; ctx->error = X509_V_ERR_NO_EXPLICIT_POLICY; return ctx->verify_cb(0, ctx); } + if (ret != X509_PCY_TREE_VALID) { + X509err(X509_F_CHECK_POLICY, ERR_R_INTERNAL_ERROR); + return 0; + } if (ctx->param->flags & X509_V_FLAG_NOTIFY_POLICY) { ctx->current_cert = NULL; |