mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-18 04:29:27 +00:00
Marius Ciepluch
0116f9bea6
Harvest 176 isolated vuln-vs-fix functions (109 CVEs, 352 training rows) into benchmarks/pairs/vfc with provenance and a JSONL training manifest. Score the slice as an honesty dashboard (ousast pairs --slice vfc); keep the pair gate on the local fixtures only.
38 lines
1.3 KiB
C
38 lines
1.3 KiB
C
/* Provenance: openssl/openssl check_delta_base (fixed).
|
|
* repo: openssl/openssl
|
|
* commit: 59c3b3158553ab53275bbbccca5cb305d591cf2e
|
|
* parent: d044f9252fe9a54001986fb4eb4e32076a056527
|
|
* commit_url: https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e
|
|
* cve: CVE-2026-28388
|
|
* license: Apache-2.0
|
|
* function: check_delta_base
|
|
* relpath: crypto/x509/x509_vfy.c
|
|
*/
|
|
|
|
static int check_delta_base(X509_CRL *delta, X509_CRL *base)
|
|
{
|
|
/* Delta CRL must be a delta */
|
|
if (delta->base_crl_number == NULL)
|
|
return 0;
|
|
/* Base must have a CRL number */
|
|
if (base->crl_number == NULL)
|
|
return 0;
|
|
/* Issuer names must match */
|
|
if (X509_NAME_cmp(X509_CRL_get_issuer(base),
|
|
X509_CRL_get_issuer(delta))
|
|
!= 0)
|
|
return 0;
|
|
/* AKID and IDP must match */
|
|
if (!crl_extension_match(delta, base, NID_authority_key_identifier))
|
|
return 0;
|
|
if (!crl_extension_match(delta, base, NID_issuing_distribution_point))
|
|
return 0;
|
|
/* Delta CRL base number must not exceed Full CRL number. */
|
|
if (ASN1_INTEGER_cmp(delta->base_crl_number, base->crl_number) > 0)
|
|
return 0;
|
|
/* Delta CRL number must exceed full CRL number */
|
|
if (delta->crl_number == NULL)
|
|
return 0;
|
|
return ASN1_INTEGER_cmp(delta->crl_number, base->crl_number) > 0;
|
|
}
|