[openssl-commits] [openssl] master update

[Dr. Stephen Henson]

The branch master has been updated
       via  e032117db251968bd09badc7d4718c2497302e55 (commit)
      from  e040a42e44b40f09ce485f66c9198456a3f8a457 (commit)


- Log -----------------------------------------------------------------
commit e032117db251968bd09badc7d4718c2497302e55
Author: Dr. Stephen Henson <steve at openssl.org>
Date:   Fri Jul 29 17:54:52 2016 +0100

    Fix CRL time comparison.
    
    Thanks to David Benjamin <davidben at google.com> for reporting this bug.
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 crypto/x509/x509_vfy.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c
index abe9caa..099a4d8 100644
--- a/crypto/x509/x509_vfy.c
+++ b/crypto/x509/x509_vfy.c
@@ -979,7 +979,11 @@ static int get_crl_sk(X509_STORE_CTX *ctx, X509_CRL **pcrl, X509_CRL **pdcrl,
             if (ASN1_TIME_diff(&day, &sec, X509_CRL_get_lastUpdate(best_crl),
                                X509_CRL_get_lastUpdate(crl)) == 0)
                 continue;
-            if (day < 0 || sec <= 0)
+            /*
+             * ASN1_TIME_diff never returns inconsistent signs for |day|
+             * and |sec|.
+             */
+            if (day <= 0 && sec <= 0)
                 continue;
         }
         best_crl = crl;