From 8a57ca84c35c142104359107d8cdd4b027b36183 Mon Sep 17 00:00:00 2001
From: Juliusz Sosinowicz <juliusz@wolfssl.com>
Date: Mon, 9 Mar 2026 18:35:52 +0100
Subject: [PATCH] CheckCertCRL_ex: check `cbRet` after callback

F-432
---
 src/crl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/crl.c b/src/crl.c
index c6a9632603..b382ef7baf 100644
--- a/src/crl.c
+++ b/src/crl.c
@@ -591,7 +591,7 @@ int CheckCertCRL_ex(WOLFSSL_CRL* crl, byte* issuerHash, byte* serial,
             if (cbRet == WC_NO_ERR_TRACE(WOLFSSL_CBIO_ERR_WANT_READ)) {
                 ret = OCSP_WANT_READ;
             }
-            else if (ret >= 0) {
+            else if (cbRet >= 0) {
                 /* try again */
                 ret = CheckCertCRLList(crl, issuerHash, serial, serialSz,
                         serialHash, &foundEntry);