CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2026/09/16 17:40:48
Modified files:
lib/libcrypto/x509: x509_vfy.c
Log message:
get_crl_score: delta CRLs should not be used as full CRLs
The glorious OpenSSL invention called CRL score is backed by muppety code
that is an obvious bug magnet. If extended CRL support is enabled and the
delta CRL has onlySomeReasons, the logic that is supposed to reject delta
certs is not reached. Fix this by pulling it up.
Reported by Frank Denis and Acts1631.
ok kenjiro
