# HG changeset patch
# User mullan
# Date 1259002672 18000
# Node ID 7c352d15334c9f175fa18daaa60a7e545549d873
# Parent  38a035021ba1d7ec6b76499c31f77a934bac8d74# Parent  6874332ce9591eff73250dc7958f510e7a2f993d
Merge

diff -r 38a035021ba1 -r 7c352d15334c jdk/src/share/classes/sun/security/validator/PKIXValidator.java
--- a/jdk/src/share/classes/sun/security/validator/PKIXValidator.java	Mon Nov 23 10:29:33 2009 -0700
+++ b/jdk/src/share/classes/sun/security/validator/PKIXValidator.java	Mon Nov 23 13:57:52 2009 -0500
@@ -150,9 +150,17 @@
                 ("null or zero-length certificate chain");
         }
         if (TRY_VALIDATOR) {
-            // check if chain contains trust anchor
+            // check that chain is in correct order and check if chain contains
+            // trust anchor
+            X500Principal prevIssuer = null;
             for (int i = 0; i < chain.length; i++) {
-                if (trustedCerts.contains(chain[i])) {
+                X509Certificate cert = chain[i];
+                if (i != 0 &&
+                    !cert.getSubjectX500Principal().equals(prevIssuer)) {
+                    // chain is not ordered correctly, call builder instead
+                    return doBuild(chain, otherCerts);
+                }
+                if (trustedCerts.contains(cert)) {
                     if (i == 0) {
                         return new X509Certificate[] {chain[0]};
                     }
@@ -161,6 +169,7 @@
                     System.arraycopy(chain, 0, newChain, 0, i);
                     return doValidate(newChain);
                 }
+                prevIssuer = cert.getIssuerX500Principal();
             }
 
             // apparently issued by trust anchor?
@@ -303,5 +312,4 @@
                 ("PKIX path building failed: " + e.toString(), e);
         }
     }
-
 }