543adc4de0
Daniel Stenberg
2026-08-31
Subject
openssl: avoid strlen() on the data from OpenSSL
Binary
No binary (build failed)
Architecture & Compiler Flags
—
Build Log
(log yok)
Commit Diff GitHub →
lib/vtls/openssl.c+1 -11
| @@ -2104,17 +2104,7 @@ static CURLcode ossl_verifyhost(struct Curl_easy *data, | |
| switch(target) { | |
| case GEN_DNS: /* name/pattern comparison */ | |
| - | /* The OpenSSL man page explicitly says: "In general it cannot be |
| - | assumed that the data returned by ASN1_STRING_data() is null |
| - | terminated or does not contain embedded nulls.", but also that |
| - | "The actual format of the data depends on the actual string |
| - | type itself: for example for an IA5String the data is ASCII" |
| - | |
| - | It has been however verified that in 0.9.6 and 0.9.7, IA5String |
| - | is always null-terminated. */ |
| - | if((altlen == strlen(altptr)) && |
| - | /* if this is not true, there was an embedded zero in the name |
| - | string and we cannot match it. */ |
| + | if(!memchr(altptr, '\0', altlen) && |
| Curl_cert_hostcheck(altptr, altlen, | |
| peer->origin->hostname, hostlen)) { | |
| matched = TRUE; | |