[openssl.org #2404] bug in X509_check_issued when compare akid->issuer with issuer

Sun, 26 Dec 2010 12:34:37 -0800 

openssl-0.9.8q: crypro/x509v3/v3_purp.c:667

int X509_check_issued(X509 *issuer, X509 *subject)
{
        ...

            if(nm && X509_NAME_cmp(nm, X509_get_issuer_name(issuer)))
                return X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH;
        }
    }

    ...


X509_get_issuer_name(issuer) means issuer's issuer, I think the correct code is


            if(nm && X509_NAME_cmp(nm, X509_get_subject_name(issuer)))
                return X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH;
        }



--
Zhang. XiaoYu
mailtoļ¼š[email protected]

______________________________________________________________________
OpenSSL Project                                 http://www.openssl.org
Development Mailing List                       [email protected]
Automated List Manager                           [email protected]

Reply via email to