Corrected bit disable (was flipping instead).

Initialy reported by Daniel Kahn Gillmor on 9/1/2008. Many thanks to
moog@sysdev.oucs.ox.ac.uk for bringing this into my attention.

diff --git a/lib/x509/verify.c b/lib/x509/verify.c
index af97f4b0a3f0625506de3b9dabe39ca5f88ab153..4b1252e85d675e63875edf89a8c6ce50bccc9d8c 100644 (file)
--- a/lib/x509/verify.c
+++ b/lib/x509/verify.c
@@ -504,7 +504,7 @@ _gnutls_x509_verify_certificate (const gnutls_x509_crt_t * certificate_list,
        * certificates can exist in a supplied chain.
        */
       if (!(flags & GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT))
-       flags ^= GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT;
+       flags &= ~(GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT);
       if ((ret =
           _gnutls_verify_certificate2 (certificate_list[i - 1],
                                        &certificate_list[i], 1, flags,