CRL NextUpdate can be null

- see https://github.com/bcgit/bc-csharp/issues/315

1 files changed, 8 insertions, 12 deletions

diff --git a/crypto/src/pkix/PkixCrlUtilities.cs b/crypto/src/pkix/PkixCrlUtilities.cs
index c386b8a05..06a7caa2a 100644
--- a/crypto/src/pkix/PkixCrlUtilities.cs
+++ b/crypto/src/pkix/PkixCrlUtilities.cs
@@ -2,6 +2,7 @@ using System;
 using System.Collections;
 
 using Org.BouncyCastle.Utilities.Collections;
+using Org.BouncyCastle.Utilities.Date;
 using Org.BouncyCastle.X509;
 using Org.BouncyCastle.X509.Store;
 
@@ -35,21 +36,16 @@ namespace Org.BouncyCastle.Pkix
 			// based on RFC 5280 6.3.3
 			foreach (X509Crl crl in initialSet)
 			{
-				if (crl.NextUpdate.Value.CompareTo(validityDate) > 0)
+                DateTimeObject nextUpdate = crl.NextUpdate;
+
+                if (null == nextUpdate || nextUpdate.Value.CompareTo(validityDate) > 0)
 				{
 					X509Certificate cert = crlselect.CertificateChecking;
 
-					if (cert != null)
-					{
-						if (crl.ThisUpdate.CompareTo(cert.NotAfter) < 0)
-						{
-							finalSet.Add(crl);
-						}
-					}
-					else
-					{
-						finalSet.Add(crl);
-					}
+                    if (null == cert || crl.ThisUpdate.CompareTo(cert.NotAfter) < 0)
+                    {
+                        finalSet.Add(crl);
+                    }
 				}
 			}