feedc0de/wolfssl
1
0
Fork 0
forked from wolfSSL/wolfssl
Code Pull Requests Activity

Code review

Browse Source
This commit is contained in:
Juliusz Sosinowicz
2023-07-06 11:55:20 +02:00
parent d2642e329d
commit c041863aaa
2 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
src/internal.c
View File

@@ -12653,7 +12653,8 @@ void DoCertFatalAlert(WOLFSSL* ssl, int ret)
alertWhy = bad_certificate; alertWhy = bad_certificate;
if (ret == ASN_AFTER_DATE_E || ret == ASN_BEFORE_DATE_E) { if (ret == ASN_AFTER_DATE_E || ret == ASN_BEFORE_DATE_E) {
alertWhy = certificate_expired; alertWhy = certificate_expired;
} else if (ret == ASN_NO_SIGNER_E || ret == ASN_PATHLEN_INV_E || }
else if (ret == ASN_NO_SIGNER_E || ret == ASN_PATHLEN_INV_E ||
ret == ASN_PATHLEN_SIZE_E) { ret == ASN_PATHLEN_SIZE_E) {
alertWhy = unknown_ca; alertWhy = unknown_ca;
} }

11
wolfcrypt/src/asn.c
View File

@@ -22634,13 +22634,12 @@ int ParseCertRelative(DecodedCert* cert, int type, int verify, void* cm)
cert->maxPathLen = cert->pathLength; cert->maxPathLen = cert->pathLength;
if (!cert->selfSigned) { if (!cert->selfSigned) {
if (/* Need to perform a pathlen check on anything that will be used /* Need to perform a pathlen check on anything that will be used
* to sign certificates later on. Otherwise, pathLen doesn't * to sign certificates later on. Otherwise, pathLen doesn't
* mean anything. */ * mean anything.
type != CERT_TYPE && cert->isCA && cert->extKeyUsageSet && * Nothing to check if we don't have the issuer of this cert. */
(cert->extKeyUsage & KEYUSE_KEY_CERT_SIGN) != 0 && if (type != CERT_TYPE && cert->isCA && cert->extKeyUsageSet &&
/* Nothing to check if we don't have the issuer of this cert. */ (cert->extKeyUsage & KEYUSE_KEY_CERT_SIGN) != 0 && cert->ca) {
cert->ca) {
if (cert->ca->maxPathLen == 0) { if (cert->ca->maxPathLen == 0) {
/* This cert CAN NOT be used as an intermediate cert. The /* This cert CAN NOT be used as an intermediate cert. The
* issuer does not allow it. */ * issuer does not allow it. */