From: Martin Willi <martin@revosec.ch>
Date: Thu, 23 Dec 2010 10:44:36 +0000 (+0100)
Subject: Check for issuer only if we actually got a CRL
X-Git-Tag: 4.5.1~156
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d3a18dade133a782fc64c502c51ded050e357133;p=thirdparty%2Fstrongswan.git

Check for issuer only if we actually got a CRL
---

diff --git a/src/libstrongswan/plugins/revocation/revocation_validator.c b/src/libstrongswan/plugins/revocation/revocation_validator.c
index be6d3a9a63..0aeea41cab 100644
--- a/src/libstrongswan/plugins/revocation/revocation_validator.c
+++ b/src/libstrongswan/plugins/revocation/revocation_validator.c
@@ -457,15 +457,15 @@ static cert_validation_t find_crl(x509_t *subject, identification_t *issuer,
 		{
 			*uri_found = TRUE;
 			current = fetch_crl(uri);
-			if (!current->has_issuer(current, issuer))
-			{
-				DBG1(DBG_CFG, "issuer of fetched CRL '%Y' does not match CRL "
-					 "issuer '%Y'", current->get_issuer(current), issuer);
-				current->destroy(current);
-				continue;
-			}
 			if (current)
 			{
+				if (!current->has_issuer(current, issuer))
+				{
+					DBG1(DBG_CFG, "issuer of fetched CRL '%Y' does not match CRL "
+						 "issuer '%Y'", current->get_issuer(current), issuer);
+					current->destroy(current);
+					continue;
+				}
 				*best = get_better_crl(current, *best, subject,
 									   &valid, auth, TRUE);
 				if (*best && valid != VALIDATION_STALE)