Handle policy check at trust anchor

svn path=/openssl/trunk/crypto/x509v3/pcy_tree.c; revision=152

1 files changed, 10 insertions, 0 deletions

diff --git a/openssl/trunk/crypto/x509v3/pcy_tree.c b/openssl/trunk/crypto/x509v3/pcy_tree.c
index 1c68ce33..511881d7 100644
--- a/openssl/trunk/crypto/x509v3/pcy_tree.c
+++ b/openssl/trunk/crypto/x509v3/pcy_tree.c
@@ -628,6 +628,16 @@ int X509_policy_check(X509_POLICY_TREE **ptree, int *pexplicit_policy,
 		/* Tree OK: continue */
 
 		case 1:
+		if (!tree)
+			/*
+			 * tree_init() returns success and a null tree
+			 * if it's just looking at a trust anchor.
+			 * I'm not sure that returning success here is
+			 * correct, but I'm sure that reporting this
+			 * as an internal error which our caller
+			 * interprets as a malloc failure is wrong.
+			 */
+			return 1;
 		break;
 		}