CERTCrlEntry **entries; CERTCrlEntry *entry;
SECStatus cert_check_crl_version (CERTCrl *crl){    CERTCrlEntry **entries;    CERTCrlEntry *entry;    PRBool hasCriticalExten = PR_FALSE;    SECStatus rv = SECSuccess;    int version;    /* CRL version is defaulted to v1 */    version = SEC_CRL_VERSION_1;    if (crl->version.data != 0) 	version = (int)DER_GetUInteger (&crl->version);	    if (version > SEC_CRL_VERSION_2) {	PORT_SetError (SEC_ERROR_BAD_DER);	return (SECFailure);    }    /* Check the crl extensions for a critial extension.  If one is found,       and the version is not v2, then we are done.     */    if (crl->extensions) {	hasCriticalExten = cert_HasCriticalExtension (crl->extensions);	if (hasCriticalExten) {	    if (version != SEC_CRL_VERSION_2)		return (SECFailure);	    /* make sure that there is no unknown critical extension */	    if (cert_HasUnknownCriticalExten (crl->extensions) == PR_TRUE) {		PORT_SetError (SEC_ERROR_UNKNOWN_CRITICAL_EXTENSION);		return (SECFailure);	    }	}    }	    if (crl->entries == NULL) {        return (SECSuccess);    }    /* Look in the crl entry extensions.  If there is a critical extension,       then the crl version must be v2; otherwise, it should be v1.     */    entries = crl->entries;    while (*entries) {	entry = *entries;	if (entry->extensions) {	    /* If there is a critical extension in the entries, then the	       CRL must be of version 2.  If we already saw a critical extension,	       there is no need to check the version again.	    */	    if (hasCriticalExten == PR_FALSE) {		hasCriticalExten = cert_HasCriticalExtension (entry->extensions);		if (hasCriticalExten && version != SEC_CRL_VERSION_2) { 		    rv = SECFailure;		    break;		}	    }	    /* For each entry, make sure that it does not contain an unknown	       critical extension.  If it does, we must reject the CRL since	       we don't know how to process the extension.	    */	    if (cert_HasUnknownCriticalExten (entry->extensions) == PR_TRUE) {		PORT_SetError (SEC_ERROR_UNKNOWN_CRITICAL_EXTENSION);		rv = SECFailure;		break;	    }	}	++entries;    }    if (rv == SECFailure)	return (rv);    return (SECSuccess);}