diff options
| author | Stefan Sørensen <stefan.sorensen@spectralink.com> | 2016-08-08 13:31:15 +0200 |
|---|---|---|
| committer | Nikos Mavrogiannopoulos <nmav@redhat.com> | 2016-08-08 16:10:31 +0200 |
| commit | 67fc652b5d703d6955f43811e24c06de9a9cc7c9 (patch) | |
| tree | 3f744f08f82a5e959fdaf18ba3feae4c222f7afc | |
| parent | f7d884720b128ef86f6b9dc9fc498be89faf1732 (diff) | |
| download | gnutls-stefan-fixes.tar.gz | |
Fix gnutls_pkcs12_simple_parse to always extract the complete chainstefan-fixes
gnutls_pkcs12_simple_parse was only collecting extra certificates that was
possible elements of the certificate chain when the extra_certs argument was
not NULL. Fix by allways collecting all the certificates, any unneeded
certificates are released before returning if extra_certs is NULL anyway.
Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
| -rw-r--r-- | lib/x509/pkcs12.c | 35 |
1 files changed, 15 insertions, 20 deletions
diff --git a/lib/x509/pkcs12.c b/lib/x509/pkcs12.c index 5b072dd8e6..e39dcde790 100644 --- a/lib/x509/pkcs12.c +++ b/lib/x509/pkcs12.c @@ -1683,27 +1683,22 @@ gnutls_pkcs12_simple_parse(gnutls_pkcs12_t p12, } if (memcmp(cert_id, key_id, cert_id_size) != 0) { /* they don't match - skip the certificate */ - if (extra_certs) { - _extra_certs = - gnutls_realloc_fast - (_extra_certs, - sizeof(_extra_certs - [0]) * - ++_extra_certs_len); - if (!_extra_certs) { - gnutls_assert(); - ret = - GNUTLS_E_MEMORY_ERROR; - goto done; - } - _extra_certs - [_extra_certs_len - - 1] = this_cert; - this_cert = NULL; - } else { - gnutls_x509_crt_deinit - (this_cert); + _extra_certs = + gnutls_realloc_fast + (_extra_certs, + sizeof(_extra_certs + [0]) * + ++_extra_certs_len); + if (!_extra_certs) { + gnutls_assert(); + ret = + GNUTLS_E_MEMORY_ERROR; + goto done; } + _extra_certs + [_extra_certs_len - + 1] = this_cert; + this_cert = NULL; } else { if (chain && _chain_len == 0) { _chain = |