commit 9f9fad0191028edc43d100d0ded39419b6895fdf
author djm@openbsd.org <djm@openbsd.org> Mon Nov 17 00:21:40 2014 +0000
committer Damien Miller <djm@mindrot.org> Mon Nov 17 11:20:39 2014 +1100
tree 83a1dabec592abd8220ff622857d5e50d15e4c75
parent da8af83d3f7ec00099963e455010e0ed1d7d0140

upstream commit

fix KRL generation when multiple CAs are in use

We would generate an invalid KRL when revoking certs by serial
number for multiple CA keys due to a section being written out
twice.

Also extend the regress test to catch this case by having it
produce a multi-CA KRL.

Reported by peter AT pean.org

krl.c

diff --git a/krl.c b/krl.c
index eb31df9..832ac8b 100644
--- a/krl.c
+++ b/krl.c
@@ -14,7 +14,7 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $OpenBSD: krl.c,v 1.17 2014/06/24 01:13:21 djm Exp $ */
+/* $OpenBSD: krl.c,v 1.18 2014/11/17 00:21:40 djm Exp $ */
 
 #include "includes.h"
 
@@ -686,6 +686,7 @@
 
 	/* Store sections for revoked certificates */
 	TAILQ_FOREACH(rc, &krl->revoked_certs, entry) {
+		buffer_clear(&sect);
 		if (revoked_certs_generate(rc, &sect) != 0)
 			goto out;
 		buffer_put_char(buf, KRL_SECTION_CERTIFICATES);