tree c54ea57e9eaa45e89efeb9f56b89631773e9a83a
parent f83a4685e1528a5ebee78469d2a3262e2d505b0b
author Dmitri Shuralyov <dmitshur@golang.org> 1572279041 -0400
committer Dmitri Shuralyov <dmitshur@golang.org> 1572319104 +0000

acme/autocert: always pass AuthzURLs from AuthorizeOrder to deactivatePendingAuthz

Previously, the o.AuthzURLs slice was sometimes used from the call to
client.WaitOrder at the bottom of the for loop.

By that point, o may be nil if client.WaitOrder returned an error,
which would cause a nil pointer dereference panic inside the deferred
function call. If client.WaitOrder did not return an error, then the
call to deactivatePendingAuthz would use its AuthzURLs slice instead
of the one from client.AuthorizeOrder.

Fixes golang/go#35225
Updates golang/go#21081

Change-Id: I7db055ee1149871b6e5d34a8618526899c68f827
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/203919
Reviewed-by: Alex Vaghin <ddos@google.com>