/* Provenance: openssl/openssl check_delta_base (fixed).
 * repo: openssl/openssl
 * commit: 59c3b3158553ab53275bbbccca5cb305d591cf2e
 * parent: d044f9252fe9a54001986fb4eb4e32076a056527
 * commit_url: https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e
 * cve: CVE-2026-28388
 * license: Apache-2.0
 * function: check_delta_base
 * relpath: crypto/x509/x509_vfy.c
 */

static int check_delta_base(X509_CRL *delta, X509_CRL *base)
{
    /* Delta CRL must be a delta */
    if (delta->base_crl_number == NULL)
        return 0;
    /* Base must have a CRL number */
    if (base->crl_number == NULL)
        return 0;
    /* Issuer names must match */
    if (X509_NAME_cmp(X509_CRL_get_issuer(base),
            X509_CRL_get_issuer(delta))
        != 0)
        return 0;
    /* AKID and IDP must match */
    if (!crl_extension_match(delta, base, NID_authority_key_identifier))
        return 0;
    if (!crl_extension_match(delta, base, NID_issuing_distribution_point))
        return 0;
    /* Delta CRL base number must not exceed Full CRL number. */
    if (ASN1_INTEGER_cmp(delta->base_crl_number, base->crl_number) > 0)
        return 0;
    /* Delta CRL number must exceed full CRL number */
    if (delta->crl_number == NULL)
        return 0;
    return ASN1_INTEGER_cmp(delta->crl_number, base->crl_number) > 0;
}