Check for issuer only if we actually got a CRL

diff --git a/src/libstrongswan/plugins/revocation/revocation_validator.c b/src/libstrongswan/plugins/revocation/revocation_validator.c
index be6d3a9a63e15d1a9ff10551ff2d240747dabc99..0aeea41cab30610f553f4609270869d3d6e53bf4 100644 (file)
--- a/src/libstrongswan/plugins/revocation/revocation_validator.c
+++ b/src/libstrongswan/plugins/revocation/revocation_validator.c
@@ -457,15 +457,15 @@ static cert_validation_t find_crl(x509_t *subject, identification_t *issuer,
                {
                        *uri_found = TRUE;
                        current = fetch_crl(uri);
-                       if (!current->has_issuer(current, issuer))
-                       {
-                               DBG1(DBG_CFG, "issuer of fetched CRL '%Y' does not match CRL "
-                                        "issuer '%Y'", current->get_issuer(current), issuer);
-                               current->destroy(current);
-                               continue;
-                       }
                        if (current)
                        {
+                               if (!current->has_issuer(current, issuer))
+                               {
+                                       DBG1(DBG_CFG, "issuer of fetched CRL '%Y' does not match CRL "
+                                                "issuer '%Y'", current->get_issuer(current), issuer);
+                                       current->destroy(current);
+                                       continue;
+                               }
                                *best = get_better_crl(current, *best, subject,
                                                                           &valid, auth, TRUE);
                                if (*best && valid != VALIDATION_STALE)