From bf24a103424334af46d2cf695b6e60f39ce9e3a8 Mon Sep 17 00:00:00 2001
From: tb <>
Date: Tue, 23 Jun 2026 08:28:06 +0000
Subject: crl_cb(): fix EXFLAG_CRITICAL mishandling

The EXFLAG_CRITICAL should be set on encountering a critical CRL
extension unsupported by the library. The current loop does the
opposite: it stops looking as soon as it finds the first critical
extension the library supports...

ok kenjiro
---
 src/lib/libcrypto/asn1/x_crl.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'src/lib')

diff --git a/src/lib/libcrypto/asn1/x_crl.c b/src/lib/libcrypto/asn1/x_crl.c
index d95b044a89..0b8631e65d 100644
--- a/src/lib/libcrypto/asn1/x_crl.c
+++ b/src/lib/libcrypto/asn1/x_crl.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x_crl.c,v 1.52 2026/04/07 12:52:19 tb Exp $ */
+/* $OpenBSD: x_crl.c,v 1.53 2026/06/23 08:28:06 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -326,7 +326,7 @@ crl_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it, void *exarg)
 				if (nid == NID_issuing_distribution_point ||
 				    nid == NID_authority_key_identifier ||
 				    nid == NID_delta_crl)
-					break;
+					continue;
 				crl->flags |= EXFLAG_CRITICAL;
 				break;
 			}
-- 
cgit v1.2.3-55-g6feb