Index: gnutls-2.4.1/lib/x509/verify.c
===================================================================
--- gnutls-2.4.1.orig/lib/x509/verify.c
+++ gnutls-2.4.1/lib/x509/verify.c
@@ -36,6 +36,7 @@
 #include <gnutls_str.h>
 #include <gnutls_datum.h>
 #include "x509_int.h"
+#include <string.h>
 #include <common.h>
 
 static int _gnutls_verify_certificate2 (gnutls_x509_crt_t cert,
@@ -69,7 +70,8 @@ check_if_ca (gnutls_x509_crt_t cert, gnu
   gnutls_datum_t issuer_signed_data = { NULL, 0 };
   gnutls_datum_t cert_signature = { NULL, 0 };
   gnutls_datum_t issuer_signature = { NULL, 0 };
-  int result;
+  int pathlen = -1, result = 0;
+  unsigned int ca_status = 0;
 
   /* Check if the issuer is the same with the
    * certificate. This is added in order for trusted
@@ -82,7 +84,7 @@ check_if_ca (gnutls_x509_crt_t cert, gnu
   if (result < 0)
     {
       gnutls_assert ();
-      goto cleanup;
+	goto fail;
     }
 
   result =
@@ -91,7 +93,7 @@ check_if_ca (gnutls_x509_crt_t cert, gnu
   if (result < 0)
     {
       gnutls_assert ();
-      goto cleanup;
+	goto fail;
     }
 
   result =
@@ -99,7 +101,7 @@ check_if_ca (gnutls_x509_crt_t cert, gnu
   if (result < 0)
     {
       gnutls_assert ();
-      goto cleanup;
+	goto fail;
     }
 
   result =
@@ -107,7 +109,7 @@ check_if_ca (gnutls_x509_crt_t cert, gnu
   if (result < 0)
     {
       gnutls_assert ();
-      goto cleanup;
+	goto fail;
     }
 
   /* If the subject certificate is the same as the issuer
@@ -147,6 +149,7 @@ check_if_ca (gnutls_x509_crt_t cert, gnu
   else
 	  gnutls_assert ();
 
+fail:
   result = 0;
 
 cleanup:
@@ -177,6 +180,7 @@ is_issuer (gnutls_x509_crt_t cert, gnutl
   if (ret < 0)
     {
       gnutls_assert ();
+	ret = 0;
       goto cleanup;
     }
 
@@ -184,10 +188,16 @@ is_issuer (gnutls_x509_crt_t cert, gnutl
   if (ret < 0)
     {
       gnutls_assert ();
+	ret = 0;
       goto cleanup;
     }
 
-  ret = _gnutls_x509_compare_raw_dn (&dn1, &dn2);
+    ret = _gnutls_x509_compare_raw_dn(&dn1, &dn2);
+       if( ret < 0){
+               gnutls_assert();
+               ret = 0;
+               goto cleanup;
+       }
 
 cleanup:
   _gnutls_free_datum (&dn1);
@@ -239,7 +249,7 @@ _gnutls_verify_certificate2 (gnutls_x509
   gnutls_datum_t cert_signed_data = { NULL, 0 };
   gnutls_datum_t cert_signature = { NULL, 0 };
   gnutls_x509_crt_t issuer;
-  int ret, issuer_version, result;
+  int ret, issuer_version, result=0;
 
   if (output)
     *output = 0;
@@ -269,13 +279,14 @@ _gnutls_verify_certificate2 (gnutls_x509
   if (issuer_version < 0)
     {
       gnutls_assert ();
-      return issuer_version;
+	result = 0;
+	goto cleanup;
     }
 
   if (!(flags & GNUTLS_VERIFY_DISABLE_CA_SIGN) &&
       !((flags & GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT) && issuer_version == 1))
     {
-      if (check_if_ca (cert, issuer, flags) == 0)
+      if (check_if_ca (cert, issuer, flags) != 1)
 	{
 	  gnutls_assert ();
 	  if (output)
@@ -290,6 +301,7 @@ _gnutls_verify_certificate2 (gnutls_x509
   if (result < 0)
     {
       gnutls_assert ();
+	result = 0;
       goto cleanup;
     }
 
@@ -298,6 +310,7 @@ _gnutls_verify_certificate2 (gnutls_x509
   if (result < 0)
     {
       gnutls_assert ();
+	result = 0;
       goto cleanup;
     }
 
@@ -307,6 +320,8 @@ _gnutls_verify_certificate2 (gnutls_x509
   if (ret < 0)
     {
       gnutls_assert ();
+	ret = result = 0;
+	goto cleanup;
     }
   else if (ret == 0)
     {
@@ -385,9 +400,8 @@ _gnutls_x509_verify_certificate (const g
 				 const gnutls_x509_crl_t * CRLs,
 				 int crls_size, unsigned int flags)
 {
-  int i = 0, ret;
-  unsigned int status = 0, output;
-
+	int i = 0, ret = 0;
+	unsigned int status = 0, output = 0;
   /* Verify the last certificate in the certificate path
    * against the trusted CA certificate list.
    *
@@ -398,7 +412,7 @@ _gnutls_x509_verify_certificate (const g
     _gnutls_verify_certificate2 (certificate_list[clist_size - 1],
 				 trusted_cas, tcas_size, flags, &output);
 
-  if (ret == 0)
+  if (ret != 1)
     {
       /* if the last certificate in the certificate
        * list is invalid, then the certificate is not
@@ -441,7 +455,7 @@ _gnutls_x509_verify_certificate (const g
       if ((ret =
 	   _gnutls_verify_certificate2 (certificate_list[i - 1],
 					&certificate_list[i], 1, flags,
-					NULL)) == 0)
+					NULL)) != 1)
 	{
 	  status |= GNUTLS_CERT_INVALID;
 	  return status;
@@ -869,7 +883,7 @@ gnutls_x509_crl_verify (gnutls_x509_crl_
 			int CA_list_length, unsigned int flags,
 			unsigned int *verify)
 {
-  int ret;
+  int ret = 0;
   /* Verify crl 
    */
   ret = _gnutls_verify_crl2 (crl, CA_list, CA_list_length, flags, verify);
@@ -920,7 +934,7 @@ static inline gnutls_x509_crt_t
 find_crl_issuer (gnutls_x509_crl_t crl,
 		 const gnutls_x509_crt_t * trusted_cas, int tcas_size)
 {
-  int i;
+  int i=0;
 
   /* this is serial search. 
    */
