From 3aa7b2dc3a39b85a371acc133427b26570dbc69d Mon Sep 17 00:00:00 2001
From: SophieK <35367649+suishixingkong@users.noreply.github.com>
Date: Tue, 21 May 2019 09:28:21 +0800
Subject: [PATCH] Avoid enumerating certificates with non-matching key type

If the key type was specified but the ID was NULL or matched a subject, it
was possible that a certificate was returned that didn't actually match
the requested key type.

Closes strongswan/strongswan#141.
---
 src/libcharon/plugins/stroke/stroke_ca.c      | 5 +++++
 src/libstrongswan/credentials/sets/mem_cred.c | 5 +++++
 2 files changed, 10 insertions(+)

diff --git a/src/libcharon/plugins/stroke/stroke_ca.c b/src/libcharon/plugins/stroke/stroke_ca.c
index 0432ee573..2c0df8fb2 100644
--- a/src/libcharon/plugins/stroke/stroke_ca.c
+++ b/src/libcharon/plugins/stroke/stroke_ca.c
@@ -208,6 +208,11 @@ CALLBACK(certs_filter, bool,
 					return TRUE;
 				}
 			}
+			else
+			{
+				public->destroy(public);
+				continue;
+			}
 			public->destroy(public);
 		}
 		else if (data->key != KEY_ANY)
diff --git a/src/libstrongswan/credentials/sets/mem_cred.c b/src/libstrongswan/credentials/sets/mem_cred.c
index b0f77be98..86b232a3e 100644
--- a/src/libstrongswan/credentials/sets/mem_cred.c
+++ b/src/libstrongswan/credentials/sets/mem_cred.c
@@ -108,6 +108,11 @@ CALLBACK(certs_filter, bool,
 					return TRUE;
 				}
 			}
+			else
+			{
+				public->destroy(public);
+				continue;
+			}
 			public->destroy(public);
 		}
 		else if (data->key != KEY_ANY)