/* Provenance: openssl/openssl check_revocation (fixed).
 * repo: openssl/openssl
 * commit: a9af3442290e8a04706a3cd5f284ffd5b486e3f6
 * parent: 5097ec4dae239112498abb722e255ea60ef7ac48
 * commit_url: https://github.com/openssl/openssl/commit/a9af3442290e8a04706a3cd5f284ffd5b486e3f6
 * cve: CVE-2026-42765
 * license: Apache-2.0
 * function: check_revocation
 * relpath: crypto/x509/x509_vfy.c
 */

static int check_revocation(X509_STORE_CTX *ctx)
{
    int i = 0, last = 0, ok = 0;
    int crl_check_enabled = (ctx->param->flags & X509_V_FLAG_CRL_CHECK) != 0;
    int crl_check_all_enabled = crl_check_enabled && (ctx->param->flags & X509_V_FLAG_CRL_CHECK_ALL) != 0;
    int ocsp_check_enabled = (ctx->param->flags & X509_V_FLAG_OCSP_RESP_CHECK) != 0;
    int ocsp_check_all_enabled = ocsp_check_enabled && (ctx->param->flags & X509_V_FLAG_OCSP_RESP_CHECK_ALL) != 0;

    if (!crl_check_enabled && !ocsp_check_enabled)
        return 1;

    if (ocsp_check_enabled) {
#ifndef OPENSSL_NO_OCSP
        /*
         * certificate status checking with OCSP
         */
        if (ocsp_check_all_enabled)
            last = sk_X509_num(ctx->chain) - 1;
        else if (!crl_check_all_enabled && ctx->parent != NULL)
            return 1; /* If checking CRL paths this isn't the EE certificate */

        for (i = 0; i <= last; i++) {
            ctx->error_depth = i;
            ctx->current_cert = sk_X509_value(ctx->chain, i);

            /* skip if cert is apparently self-signed */
            if (ctx->current_cert->ex_flags & EXFLAG_SS)
                continue;

            /* the issuer certificate is the next in the chain */
            ctx->current_issuer = sk_X509_value(ctx->chain, i + 1);
            if (ctx->current_issuer == NULL) {
                /*
                 * No issuer exists at i+1 — this is the partial-chain
                 * trust anchor. OCSP requires an issuer to build the
                 * CertID, so skip OCSP checking for this certificate.
                 */
                if ((ctx->param->flags & X509_V_FLAG_PARTIAL_CHAIN) != 0)
                    continue;
                return verify_cb_ocsp(ctx, X509_V_ERR_OCSP_VERIFY_FAILED);
            }

            ok = check_cert_ocsp_resp(ctx);

            /*
             * In the case the certificate status is REVOKED, the verification
             * can stop here.
             */
            if (ok == V_OCSP_CERTSTATUS_REVOKED) {
                return verify_cb_ocsp(ctx, ctx->error != 0 ? ctx->error : X509_V_ERR_OCSP_VERIFY_FAILED);
            }

            /*
             * In the case the certificate status is GOOD, continue with the next
             * certificate.
             */
            if (ok == V_OCSP_CERTSTATUS_GOOD)
                continue;

            /*
             * As stated in RFC 6961 section 2.2:
             * If OCSP is not enabled or the client receives a "ocsp_response_list"
             * that does not contain a response for one or more of the certificates
             * in the completed certificate chain, the client SHOULD attempt to
             * validate the certificate using an alternative retrieval method,
             * such as downloading the relevant CRL;
             */
            if (crl_check_all_enabled || (crl_check_enabled && i == 0)) {
                ok = check_cert_crl(ctx);
                if (!ok)
                    return ok;
            } else {
                ok = verify_cb_ocsp(ctx, X509_V_ERR_OCSP_VERIFY_FAILED);
                if (!ok)
                    return ok;
            }
        }
#endif
    }

    if (crl_check_enabled && !ocsp_check_all_enabled) {
        /* certificate status check with CRLs */
        if (crl_check_all_enabled) {
            last = sk_X509_num(ctx->chain) - 1;
        } else {
            /* If checking CRL paths this isn't the EE certificate */
            if (ctx->parent != NULL)
                return 1;
            last = 0;
        }

        /*
         * in the case that OCSP is only enabled for the server certificate
         * and CRL for the complete chain, the rest of the chain has to be
         * checked here
         */
        if (ocsp_check_enabled && crl_check_all_enabled)
            i = 1;
        else
            i = 0;
        for (; i <= last; i++) {
            ctx->error_depth = i;
            ok = check_cert_crl(ctx);
            if (!ok)
                return ok;
        }
    }

    return 1;
}