commit b8acfd2ba82b0cf5d46363a45f57e298f867f519
author Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com> Thu Jun 29 11:32:44 2017 +0200
committer Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com> Tue Aug 08 11:06:50 2017 +0200
tree 539f820d9a78f173df3d601145a314bd8ee3feb5
parent 35407c7764da7998adbd13ce2efeef5c7802af59

Fix calls to check_parent()

When we're looking for a parent, in trusted CAs, 'top' should be 1.

This only impacted which call site for verify_top() was chosen, and the error
was then fixed inside verify_top() by iterating over CAs again, this time
correctly setting 'top' to 1.

library/x509_crt.c

diff --git a/library/x509_crt.c b/library/x509_crt.c
index 09ad192..a5cf450 100644
--- a/library/x509_crt.c
+++ b/library/x509_crt.c
@@ -2130,7 +2130,7 @@
          grandparent = grandparent->next )
     {
         if( x509_crt_check_parent( parent, grandparent,
-                                   0, path_cnt == 0 ) == 0 )
+                                   1, path_cnt == 0 ) == 0 )
             break;
     }
 
@@ -2321,7 +2321,7 @@
     /* Look for a parent in trusted CAs */
     for( parent = trust_ca; parent != NULL; parent = parent->next )
     {
-        if( x509_crt_check_parent( crt, parent, 0, pathlen == 0 ) == 0 )
+        if( x509_crt_check_parent( crt, parent, 1, pathlen == 0 ) == 0 )
             break;
     }