Patch fixing the bug:

https://www.gitorious.org/gnutls/gnutls/commit/855127da290a2...

Basically, the code said

    bool isOk() {
        result = someCheckReturningNegativeOnFailure()
        if (result < 0) goto cleanup;

        cleanup:
            ...
            return result; 
    }

The issue is that failure is communicated with a negative number in one case and 0 in another, and the wires got crossed.