[openssl-commits] [openssl] OpenSSL_1_0_2-stable update

[Richard Levitte]

The branch OpenSSL_1_0_2-stable has been updated
       via  ed0245e08fdf374cd6351a1ae8117d7382115a21 (commit)
      from  859a42531acf2c3547711f642bcfd7fd52eb2338 (commit)


- Log -----------------------------------------------------------------
commit ed0245e08fdf374cd6351a1ae8117d7382115a21
Author: Richard Levitte <levitte at openssl.org>
Date:   Tue Sep 26 10:45:05 2017 +0200

    Make sure that a cert with extensions gets version number 2 (v3)
    
    Fixes #4419
    
    Reviewed-by: Tim Hudson <tjh at openssl.org>
    (Merged from https://github.com/openssl/openssl/pull/4421)

-----------------------------------------------------------------------

Summary of changes:
 apps/ca.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/apps/ca.c b/apps/ca.c
index f90f033..9a83996 100644
--- a/apps/ca.c
+++ b/apps/ca.c
@@ -1985,10 +1985,6 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
     /* Lets add the extensions, if there are any */
     if (ext_sect) {
         X509V3_CTX ctx;
-        if (ci->version == NULL)
-            if ((ci->version = ASN1_INTEGER_new()) == NULL)
-                goto err;
-        ASN1_INTEGER_set(ci->version, 2); /* version 3 certificate */
 
         /*
          * Free the current entries if any, there should not be any I believe
@@ -2051,6 +2047,15 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
         goto err;
     }
 
+    {
+        STACK_OF(X509_EXTENSION) *exts = ci->extensions;
+
+        if (exts != NULL && sk_X509_EXTENSION_num(exts) > 0)
+            /* Make it an X509 v3 certificate. */
+            if (!X509_set_version(ret, 2))
+                goto err;
+    }
+
     /* Set the right value for the noemailDN option */
     if (email_dn == 0) {
         if (!X509_set_subject_name(ret, dn_subject))