if (LL_CMP(nextUpdate, <, now) || LL_CMP(producedAt, >, nextUpdate)) {
LL_ADD(tmp, tmp, nextUpdate); if (LL_CMP(tmp, <, now) || LL_CMP(producedAt, >, nextUpdate)) {
ocsp_VerifySingleResponse(CERTOCSPSingleResponse *single,			  CERTCertDBHandle *handle,			  CERTCertificate *signerCert,			  int64 producedAt){    CERTOCSPCertID *certID = single->certID;    int64 now, thisUpdate, nextUpdate, tmstamp, tmp;    SECStatus rv;    /*     * If all the responder said was that the given cert was unknown to it,     * that is a valid response.  Not very interesting to us, of course,     * but all this function is concerned with is validity of the response,     * not the status of the cert.     */    PORT_Assert(single->certStatus != NULL);    if (single->certStatus->certStatusType == ocspCertStatus_unknown)	return SECSuccess;    /*     * We need to extract "thisUpdate" for use below and to pass along     * to AuthorizedResponderForCertID in case it needs it for doing an     * issuer look-up.     */    rv = DER_GeneralizedTimeToTime(&thisUpdate, &single->thisUpdate);    if (rv != SECSuccess)	return rv;    /*     * First confirm that signerCert is authorized to give this status.     */    if (ocsp_AuthorizedResponderForCertID(handle, signerCert, certID,					  thisUpdate) != PR_TRUE)	return SECFailure;    /*     * Now check the time stuff, as described above.     */    now = PR_Now();    /* allow slop time for future response */    LL_UI2L(tmstamp, ocspsloptime); /* get slop time in seconds */    LL_UI2L(tmp, PR_USEC_PER_SEC);    LL_MUL(tmstamp, tmstamp, tmp); /* convert the slop time to PRTime */    LL_ADD(tmstamp, tmstamp, now); /* add current time to it */    if (LL_CMP(thisUpdate, >, tmstamp) || LL_CMP(producedAt, <, thisUpdate)) {	PORT_SetError(SEC_ERROR_OCSP_FUTURE_RESPONSE);	return SECFailure;    }    if (single->nextUpdate != NULL) {	rv = DER_GeneralizedTimeToTime(&nextUpdate, single->nextUpdate);	if (rv != SECSuccess)	    return rv;	if (LL_CMP(nextUpdate, <, now) || LL_CMP(producedAt, >, nextUpdate)) {	    PORT_SetError(SEC_ERROR_OCSP_OLD_RESPONSE);	    return SECFailure;	}    } else if (ocsp_TimeIsRecent(thisUpdate) != PR_TRUE) {	PORT_SetError(SEC_ERROR_OCSP_OLD_RESPONSE);	return SECFailure;    }    return SECSuccess;}