mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-18 20:49:28 +00:00
38 lines
1.3 KiB
C
38 lines
1.3 KiB
C
|
/* Provenance: openssl/openssl check_delta_base (fixed).
|
||
|
|
* repo: openssl/openssl
|
||
|
|
* commit: 59c3b3158553ab53275bbbccca5cb305d591cf2e
|
||
|
|
* parent: d044f9252fe9a54001986fb4eb4e32076a056527
|
||
|
|
* commit_url: https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e
|
||
|
|
* cve: CVE-2026-28388
|
||
|
|
* license: Apache-2.0
|
||
|
|
* function: check_delta_base
|
||
|
|
* relpath: crypto/x509/x509_vfy.c
|
||
|
|
*/
|
||
|
|
|
||
|
|
static int check_delta_base(X509_CRL *delta, X509_CRL *base)
|
||
|
|
{
|
||
|
|
/* Delta CRL must be a delta */
|
||
|
|
if (delta->base_crl_number == NULL)
|
||
|
|
return 0;
|
||
|
|
/* Base must have a CRL number */
|
||
|
|
if (base->crl_number == NULL)
|
||
|
|
return 0;
|
||
|
|
/* Issuer names must match */
|
||
|
|
if (X509_NAME_cmp(X509_CRL_get_issuer(base),
|
||
|
|
X509_CRL_get_issuer(delta))
|
||
|
|
!= 0)
|
||
|
|
return 0;
|
||
|
|
/* AKID and IDP must match */
|
||
|
|
if (!crl_extension_match(delta, base, NID_authority_key_identifier))
|
||
|
|
return 0;
|
||
|
|
if (!crl_extension_match(delta, base, NID_issuing_distribution_point))
|
||
|
|
return 0;
|
||
|
|
/* Delta CRL base number must not exceed Full CRL number. */
|
||
|
|
if (ASN1_INTEGER_cmp(delta->base_crl_number, base->crl_number) > 0)
|
||
|
|
return 0;
|
||
|
|
/* Delta CRL number must exceed full CRL number */
|
||
|
|
if (delta->crl_number == NULL)
|
||
|
|
return 0;
|
||
|
|
return ASN1_INTEGER_cmp(delta->crl_number, base->crl_number) > 0;
|
||
|
|
}
|