1 files changed, 16 insertions, 6 deletions

diff --git a/src/lib/libcrypto/x509/x509_vfy.c b/src/lib/libcrypto/x509/x509_vfy.c
index 4fdff54124..3ddb2303d3 100644
--- a/src/lib/libcrypto/x509/x509_vfy.c
+++ b/src/lib/libcrypto/x509/x509_vfy.c
@@ -436,11 +436,14 @@ static int internal_verify(X509_STORE_CTX *ctx)
                                 }
                         if (X509_verify(xs,pkey) <= 0)
                                 {
-                                EVP_PKEY_free(pkey);
                                 ctx->error=X509_V_ERR_CERT_SIGNATURE_FAILURE;
                                 ctx->current_cert=xs;
                                 ok=(*cb)(0,ctx);
-                                if (!ok) goto end;
+                                if (!ok)
+                                        {
+                                        EVP_PKEY_free(pkey);
+                                        goto end;
+                                        }
                                 }
                         EVP_PKEY_free(pkey);
                         pkey=NULL;
@@ -768,18 +771,25 @@ int X509_STORE_CTX_purpose_inherit(X509_STORE_CTX *ctx, int def_purpose,
         if(!purpose) purpose = def_purpose;
         /* If we have a purpose then check it is valid */
         if(purpose) {
+                X509_PURPOSE *ptmp;
                 idx = X509_PURPOSE_get_by_id(purpose);
                 if(idx == -1) {
                         X509err(X509_F_X509_STORE_CTX_PURPOSE_INHERIT,
                                                 X509_R_UNKNOWN_PURPOSE_ID);
                         return 0;
                 }
-                /* If trust not set then get from purpose default */
-                if(!trust) {
-                        X509_PURPOSE *ptmp;
+                ptmp = X509_PURPOSE_get0(idx);
+                if(ptmp->trust == X509_TRUST_DEFAULT) {
+                        idx = X509_PURPOSE_get_by_id(def_purpose);
+                        if(idx == -1) {
+                                X509err(X509_F_X509_STORE_CTX_PURPOSE_INHERIT,
+                                                X509_R_UNKNOWN_PURPOSE_ID);
+                                return 0;
+                        }
                         ptmp = X509_PURPOSE_get0(idx);
-                        trust = ptmp->trust;
                 }
+                /* If trust not set then get from purpose default */
+                if(!trust) trust = ptmp->trust;
         }
         if(trust) {
                 idx = X509_TRUST_get_by_id(trust);