- Chris Mumford filed bug report #2861587

  (http://curl.haxx.se/bug/view.cgi?id=2861587) identifying that libcurl used
  the OpenSSL function X509_load_crl_file() wrongly and failed if it would
  load a CRL file with more than one certificate within. This is now fixed.

diff --git a/CHANGES b/CHANGES
index c9a34891e6d2000f952a65b8adf7bafd1786b7a2..39591485499beab0aecfa8e0b71ac3dcfbbc2661 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -6,6 +6,12 @@
 
                                   Changelog
 
+Daniel Stenberg (25 Sep 2009)
+- Chris Mumford filed bug report #2861587
+  (http://curl.haxx.se/bug/view.cgi?id=2861587) identifying that libcurl used
+  the OpenSSL function X509_load_crl_file() wrongly and failed if it would
+  load a CRL file with more than one certificate within. This is now fixed.
+  
 Daniel Stenberg (16 Sep 2009)
 - Sven Anders reported that we introduced a cert verfication flaw for OpenSSL-
   powered libcurl in 7.19.6. If there was a X509v3 Subject Alternative Name

diff --git a/RELEASE-NOTES b/RELEASE-NOTES
index 6077ef25fc9c3d66c1153437f696bcbd6c5072c3..519587bc96fb55d3b54e182193bde3ccb4fefcca 100644 (file)
--- a/RELEASE-NOTES
+++ b/RELEASE-NOTES
@@ -29,6 +29,7 @@ This release includes the following bugfixes:
  o improved NSS detection in configure
  o cookie expiry date at 1970-jan-1 00:00:00
  o libcurl-OpenSSL failed to verify some certs with Subject Alternative Name
+ o libcurl-OpenSSL can load CRL files with more than one certificate inside
 
 This release includes the following known bugs:
 
@@ -39,6 +40,6 @@ advice from friends like these:
 
  Karl Moerder, Kamil Dudka, Krister Johansen, Andre Guibert de Bruet,
  Michal Marek, Eric Wong, Guenter Knauf, Peter Sylvester, Daniel Johnson,
- Claes Jakobsson, Sven Anders
+ Claes Jakobsson, Sven Anders, Chris Mumford
 
         Thanks! (and sorry if I forgot to mention someone)

diff --git a/lib/ssluse.c b/lib/ssluse.c
index 363c27a1e14ff743f1692c69679c29787b2b4b70..2ea3b2f559317f28e13c66bae5ac06997d8eab58 100644 (file)
--- a/lib/ssluse.c
+++ b/lib/ssluse.c
@@ -1536,8 +1536,8 @@ ossl_connect_step1(struct connectdata *conn,
      * revocation */
     lookup=X509_STORE_add_lookup(connssl->ctx->cert_store,X509_LOOKUP_file());
     if ( !lookup ||
-         (X509_load_crl_file(lookup,data->set.str[STRING_SSL_CRLFILE],
-                             X509_FILETYPE_PEM)!=1) ) {
+         (!X509_load_crl_file(lookup,data->set.str[STRING_SSL_CRLFILE],
+                              X509_FILETYPE_PEM)) ) {
       failf(data,"error loading CRL file :\n"
             "  CRLfile: %s\n",
             data->set.str[STRING_SSL_CRLFILE]?