pajoye Fri, 09 Oct 2009 19:08:56 +0000 Revision: http://svn.php.net/viewvc?view=revision&revision=289443
Log: - Merge: Fixed certificate validation inside php_openssl_apply_verification_policy Changed paths: U php/php-src/branches/PHP_5_3_1/ext/openssl/openssl.c Modified: php/php-src/branches/PHP_5_3_1/ext/openssl/openssl.c =================================================================== --- php/php-src/branches/PHP_5_3_1/ext/openssl/openssl.c 2009-10-09 19:06:10 UTC (rev 289442) +++ php/php-src/branches/PHP_5_3_1/ext/openssl/openssl.c 2009-10-09 19:08:56 UTC (rev 289443) @@ -4323,8 +4323,15 @@ GET_VER_OPT_STRING("CN_match", cnmatch); if (cnmatch) { int match = 0; + int name_len = X509_NAME_get_text_by_NID(name, NID_commonName, buf, sizeof(buf)); - X509_NAME_get_text_by_NID(name, NID_commonName, buf, sizeof(buf)); + if (name_len == -1) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to locate peer certificate CN"); + return FAILURE; + } else if (name_len != strlen(buf)) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Peer certificate CN=`%.*s' is malformed", name_len, buf); + return FAILURE; + } match = strcmp(cnmatch, buf) == 0; if (!match && strlen(buf) > 3 && buf[0] == '*' && buf[1] == '.') { @@ -4339,10 +4346,7 @@ if (!match) { /* didn't match */ - php_error_docref(NULL TSRMLS_CC, E_WARNING, - "Peer certificate CN=`%s' did not match expected CN=`%s'", - buf, cnmatch); - + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Peer certificate CN=`%.*s' did not match expected CN=`%s'", name_len, buf, cnmatch); return FAILURE; } }
-- PHP CVS Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php