Use simpler comparison

nhatnghiho · nhatnghiho · commit 2c746146146e · 2026-03-17T19:17:44.000Z
diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c
@@ -729,7 +729,7 @@ static int check_chain_extensions(X509_STORE_CTX *ctx) {
     }
     // Check pathlen if not self issued
     if (i > 1 && !(x->ex_flags & EXFLAG_SI) && x->ex_pathlen != -1 &&
-        (x->ex_pathlen > LONG_MAX - 1 || plen > x->ex_pathlen + 1)) {
+        plen - 1 > x->ex_pathlen) {
       ctx->error = X509_V_ERR_PATH_LENGTH_EXCEEDED;
       ctx->error_depth = i;
       ctx->current_cert = x;

Original file line number	Diff line number	Diff line change
`@@ -729,7 +729,7 @@ static int check_chain_extensions(X509_STORE_CTX *ctx) {`
`729`	`729`	`}`
`730`	`730`	`// Check pathlen if not self issued`
`731`	`731`	`if (i > 1 && !(x->ex_flags & EXFLAG_SI) && x->ex_pathlen != -1 &&`
`732`		`- (x->ex_pathlen > LONG_MAX - 1 \|\| plen > x->ex_pathlen + 1)) {`
	`732`	`+ plen - 1 > x->ex_pathlen) {`
`733`	`733`	`ctx->error = X509_V_ERR_PATH_LENGTH_EXCEEDED;`
`734`	`734`	`ctx->error_depth = i;`
`735`	`735`	`ctx->current_cert = x;`