From b8acfd2ba82b0cf5d46363a45f57e298f867f519 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Manuel=20P=C3=A9gouri=C3=A9-Gonnard?= Date: Thu, 29 Jun 2017 11:32:44 +0200 Subject: [PATCH] Fix calls to check_parent() When we're looking for a parent, in trusted CAs, 'top' should be 1. This only impacted which call site for verify_top() was chosen, and the error was then fixed inside verify_top() by iterating over CAs again, this time correctly setting 'top' to 1. --- library/x509_crt.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/library/x509_crt.c b/library/x509_crt.c index 09ad19239..a5cf45098 100644 --- a/library/x509_crt.c +++ b/library/x509_crt.c @@ -2130,7 +2130,7 @@ static int x509_crt_verify_child( grandparent = grandparent->next ) { if( x509_crt_check_parent( parent, grandparent, - 0, path_cnt == 0 ) == 0 ) + 1, path_cnt == 0 ) == 0 ) break; } @@ -2321,7 +2321,7 @@ int mbedtls_x509_crt_verify_with_profile( mbedtls_x509_crt *crt, /* Look for a parent in trusted CAs */ for( parent = trust_ca; parent != NULL; parent = parent->next ) { - if( x509_crt_check_parent( crt, parent, 0, pathlen == 0 ) == 0 ) + if( x509_crt_check_parent( crt, parent, 1, pathlen == 0 ) == 0 ) break; }