c53420e427
Rudolf Polzer
2026-09-04
Subject
ossl_verifyhost: remove assumption of null termination of ASN1_STRING.
Binary
No binary (build failed)
Architecture & Compiler Flags
—
Build Log
(log yok)
Commit Diff GitHub →
lib/vtls/openssl.c+4 -4
| @@ -2166,7 +2166,7 @@ static CURLcode ossl_verifyhost(struct Curl_easy *data, | |
| if((cnlen <= 0) || !cn) | |
| result = CURLE_OUT_OF_MEMORY; | |
| - | else if((size_t)cnlen != strlen((char *)cn)) { |
| + | else if(memchr(cn, '\0', cnlen)) { |
| /* there was a null-terminator before the end of string, this | |
| cannot match and we return failure! */ | |
| failf(data, "SSL: illegal cert name field"); | |
| @@ -2184,12 +2184,12 @@ static CURLcode ossl_verifyhost(struct Curl_easy *data, | |
| } | |
| else if(!Curl_cert_hostcheck((const char *)cn, cnlen, | |
| peer->origin->hostname, hostlen)) { | |
| - | failf(data, "SSL: certificate subject name '%s' does not match " |
| - | "target hostname '%s'", cn, peer->origin->user_hostname); |
| + | failf(data, "SSL: certificate subject name '%.*s' does not match " |
| + | "target hostname '%s'", cnlen, cn, peer->origin->user_hostname); |
| result = CURLE_PEER_FAILED_VERIFICATION; | |
| } | |
| else { | |
| - | infof(data, " common name: %s (matched)", cn); |
| + | infof(data, " common name: %.*s (matched)", cnlen, cn); |
| } | |
| if(free_cn) | |
| OPENSSL_free(cn); | |