Update to NSS 3.15.3.

nss/lib/certhigh/certvfy.c

 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 #include "nspr.h"
 #include "secerr.h"
 #include "secport.h"
 #include "seccomon.h"
 #include "secoid.h"
 #include "sslerr.h"
 #include "genname.h"
@@ skipping 1337 matching lines @@
     if ( !( certType & requiredCertType ) ) {
         PORT_SetError(SEC_ERROR_INADEQUATE_CERT_TYPE);
         LOG_ERROR_OR_EXIT(log,cert,0,requiredCertType);
     }
 
     rv = cert_CheckLeafTrust(cert,certUsage, &flags, &trusted);
     if (rv  == SECFailure) {
         PORT_SetError(SEC_ERROR_UNTRUSTED_CERT);
         LOG_ERROR_OR_EXIT(log,cert,0,flags);
     } else if (trusted) {
-        goto winner;
+        goto done;
     }
 
 
     rv = CERT_VerifyCertChain(handle, cert, checkSig, certUsage,
                               t, wincx, log);
     if (rv != SECSuccess) {
         EXIT_IF_NOT_LOGGING(log);
     }
 
     /*
      * Check revocation status, but only if the cert we are checking
      * is not a status reponder itself.  We only do this in the case
      * where we checked the cert chain (above); explicit trust "wins"
      * (avoids status checking, just as it avoids CRL checking, which
      * is all done inside VerifyCertChain) by bypassing this code.
      */
     statusConfig = CERT_GetStatusConfig(handle);
     if (certUsage != certUsageStatusResponder && statusConfig != NULL) {
         if (statusConfig->statusChecker != NULL) {
             rv = (* statusConfig->statusChecker)(handle, cert,
                                                          t, wincx);
             if (rv != SECSuccess) {
                 LOG_ERROR_OR_EXIT(log,cert,0,0);
             }
         }
     }
 
-winner:
+done:
+    if (log && log->head) {
+      return SECFailure;
+    }
     return(SECSuccess);
 
 loser:
     rv = SECFailure;
     
     return(rv);
 }
 
 /*
  * verify a certificate by checking if its valid and that we
@@ skipping 466 matching lines @@
             return chain;
         }
 
         cert = CERT_FindCertIssuer(cert, time, usage);
     }
 
     /* return partial chain */
     PORT_SetError(SEC_ERROR_UNKNOWN_ISSUER);
     return chain;
 }