3 files changed, 10 insertions, 5 deletions

diff --git a/src/lib/libcrypto/x509/x509_verify.c b/src/lib/libcrypto/x509/x509_verify.c
index 0c32cd04b7..be70ff8372 100644
--- a/src/lib/libcrypto/x509/x509_verify.c
+++ b/src/lib/libcrypto/x509/x509_verify.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_verify.c,v 1.13 2020/09/26 15:44:06 jsing Exp $ */
+/* $OpenBSD: x509_verify.c,v 1.13.4.1 2021/02/03 07:06:13 tb Exp $ */
 /*
  * Copyright (c) 2020 Bob Beck <beck@openbsd.org>
  *
@@ -81,7 +81,7 @@ x509_verify_chain_dup(struct x509_verify_chain *chain)
 {
         struct x509_verify_chain *new_chain;
 
-        if ((new_chain = x509_verify_chain_new()) == NULL)
+        if ((new_chain = calloc(1, sizeof(*chain))) == NULL)
                 goto err;
         if ((new_chain->certs = X509_chain_up_ref(chain->certs)) == NULL)
                 goto err;
diff --git a/src/lib/libcrypto/x509/x509_vfy.c b/src/lib/libcrypto/x509/x509_vfy.c
index fe1431ce49..931adb84bc 100644
--- a/src/lib/libcrypto/x509/x509_vfy.c
+++ b/src/lib/libcrypto/x509/x509_vfy.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_vfy.c,v 1.81 2020/09/26 02:06:28 deraadt Exp $ */
+/* $OpenBSD: x509_vfy.c,v 1.81.4.1 2021/02/03 07:06:13 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -1794,6 +1794,11 @@ x509_vfy_check_policy(X509_STORE_CTX *ctx)
 
         if (ctx->parent)
                 return 1;
+
+        /* X509_policy_check always allocates a new tree. */
+        X509_policy_tree_free(ctx->tree);
+        ctx->tree = NULL;
+
         ret = X509_policy_check(&ctx->tree, &ctx->explicit_policy, ctx->chain,
             ctx->param->policies, ctx->param->flags);
         if (ret == 0) {
diff --git a/src/lib/libcrypto/x509/x509_vpm.c b/src/lib/libcrypto/x509/x509_vpm.c
index 448ee20984..d4715228dc 100644
--- a/src/lib/libcrypto/x509/x509_vpm.c
+++ b/src/lib/libcrypto/x509/x509_vpm.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_vpm.c,v 1.22 2020/09/14 08:10:04 beck Exp $ */
+/* $OpenBSD: x509_vpm.c,v 1.22.4.1 2021/02/03 07:06:13 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2004.
  */
@@ -177,7 +177,7 @@ x509_verify_param_zero(X509_VERIFY_PARAM *param)
         param->trust = 0;
         /*param->inh_flags = X509_VP_FLAG_DEFAULT;*/
         param->inh_flags = 0;
-        param->flags = 0;
+        param->flags = X509_V_FLAG_LEGACY_VERIFY;
         param->depth = -1;
         if (param->policies) {
                 sk_ASN1_OBJECT_pop_free(param->policies, ASN1_OBJECT_free);