gnutls_x509_crl_verify: do not always set the invalid status

Reported by Armin Burgmeier.

1 files changed, 9 insertions, 1 deletions

diff --git a/lib/x509/verify.c b/lib/x509/verify.c
index d3f349b9a4..04ffba7e22 100644
--- a/lib/x509/verify.c
+++ b/lib/x509/verify.c
@@ -961,6 +961,8 @@ gnutls_x509_crl_verify (gnutls_x509_crl_t crl,
   if (result < 0)
     {
       gnutls_assert ();
+      if (verify)
+        *verify |= GNUTLS_CERT_INVALID;
       goto cleanup;
     }
 
@@ -968,6 +970,8 @@ gnutls_x509_crl_verify (gnutls_x509_crl_t crl,
   if (result < 0)
     {
       gnutls_assert ();
+      if (verify)
+        *verify |= GNUTLS_CERT_INVALID;
       goto cleanup;
     }
 
@@ -975,6 +979,8 @@ gnutls_x509_crl_verify (gnutls_x509_crl_t crl,
   if (result < 0)
     {
       gnutls_assert ();
+      if (verify)
+        *verify |= GNUTLS_CERT_INVALID;
       goto cleanup;
     }
 
@@ -994,6 +1000,8 @@ gnutls_x509_crl_verify (gnutls_x509_crl_t crl,
   else if (result < 0)
     {
       gnutls_assert ();
+      if (verify)
+        *verify |= GNUTLS_CERT_INVALID;
       goto cleanup;
     }
 
@@ -1021,7 +1029,7 @@ gnutls_x509_crl_verify (gnutls_x509_crl_t crl,
 
 
 cleanup:
-  if (verify) *verify |= GNUTLS_CERT_INVALID;
+  if (verify && *verify) *verify |= GNUTLS_CERT_INVALID;
 
   _gnutls_free_datum (&crl_signed_data);
   _gnutls_free_datum (&crl_signature);