openssl
diff --git a/‎crypto/x509/x509_vpm.c
Lines changed: 2 additions & 2 deletions b/‎crypto/x509/x509_vpm.c
Lines changed: 2 additions & 2 deletions
diff --git a/‎test/sslapitest.c
Lines changed: 43 additions & 0 deletions b/‎test/sslapitest.c
Lines changed: 43 additions & 0 deletions
@@ -199,7 +199,8 @@ int X509_VERIFY_PARAM_inherit(X509_VERIFY_PARAM *dest,
             return 0;
     }
 
-    /* Copy the host flags if and only if we're copying the host list */
+    x509_verify_param_copy(hostflags, 0);
+
     if (test_x509_verify_param_copy(hosts, NULL)) {
         sk_OPENSSL_STRING_pop_free(dest->hosts, str_free);
         dest->hosts = NULL;
@@ -208,7 +209,6 @@ int X509_VERIFY_PARAM_inherit(X509_VERIFY_PARAM *dest,
                 sk_OPENSSL_STRING_deep_copy(src->hosts, str_copy, str_free);
             if (dest->hosts == NULL)
                 return 0;
-            dest->hostflags = src->hostflags;
         }
     }
 
 
@@ -31,6 +31,7 @@
 #include <openssl/core_dispatch.h>
 #include <openssl/provider.h>
 #include <openssl/param_build.h>
+#include <openssl/x509v3.h>
 
 #include "helpers/ssltestlib.h"
 #include "testutil.h"
@@ -8623,6 +8624,47 @@ static int test_sni_tls13(void)
 }
 #endif
 
+static int test_inherit_verify_param(void)
+{
+    int testresult = 0;
+
+    SSL_CTX *ctx = NULL;
+    X509_VERIFY_PARAM *cp = NULL;
+    SSL *ssl = NULL;
+    X509_VERIFY_PARAM *sp = NULL;
+    int hostflags = X509_CHECK_FLAG_NEVER_CHECK_SUBJECT;
+
+    ctx = SSL_CTX_new_ex(libctx, NULL, TLS_server_method());
+    if (!TEST_ptr(ctx))
+        goto end;
+
+    cp = SSL_CTX_get0_param(ctx);
+    if (!TEST_ptr(cp))
+        goto end;
+    if (!TEST_int_eq(X509_VERIFY_PARAM_get_hostflags(cp), 0))
+        goto end;
+
+    X509_VERIFY_PARAM_set_hostflags(cp, hostflags);
+
+    ssl = SSL_new(ctx);
+    if (!TEST_ptr(ssl))
+        goto end;
+
+    sp = SSL_get0_param(ssl);
+    if (!TEST_ptr(sp))
+        goto end;
+    if (!TEST_int_eq(X509_VERIFY_PARAM_get_hostflags(sp), hostflags))
+        goto end;
+
+    testresult = 1;
+
+ end:
+    SSL_free(ssl);
+    SSL_CTX_free(ctx);
+
+    return testresult;
+}
+
 OPT_TEST_DECLARE_USAGE("certfile privkeyfile srpvfile tmpfile provider config\n")
 
 int setup_tests(void)
@@ -8872,6 +8914,7 @@ int setup_tests(void)
 #ifndef OSSL_NO_USABLE_TLS1_3
     ADD_TEST(test_sni_tls13);
 #endif
+    ADD_TEST(test_inherit_verify_param);
     return 1;
 
  err:
Original file line number	Diff line number	Diff line change
`@@ -199,7 +199,8 @@ int X509_VERIFY_PARAM_inherit(X509_VERIFY_PARAM *dest,`
`199`	`199`	`return 0;`
`200`	`200`	`}`
`201`	`201`
`202`		`- /* Copy the host flags if and only if we're copying the host list */`
	`202`	`+ x509_verify_param_copy(hostflags, 0);`
	`203`	`+`
`203`	`204`	`if (test_x509_verify_param_copy(hosts, NULL)) {`
`204`	`205`	`sk_OPENSSL_STRING_pop_free(dest->hosts, str_free);`
`205`	`206`	`dest->hosts = NULL;`
`@@ -208,7 +209,6 @@ int X509_VERIFY_PARAM_inherit(X509_VERIFY_PARAM *dest,`
`208`	`209`	`sk_OPENSSL_STRING_deep_copy(src->hosts, str_copy, str_free);`
`209`	`210`	`if (dest->hosts == NULL)`
`210`	`211`	`return 0;`
`211`		`- dest->hostflags = src->hostflags;`
`212`	`212`	`}`
`213`	`213`	`}`
`214`	`214`