CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2026/09/12 01:42:34
Modified files:
lib/libtls : tls_verify.c
Log message:
tls_verify: do not assume ASN1_STRINGs are strings
OpenSSL 4.1 no longer NUL terminates ASN.1 strings. This is fine per se,
but the fact that they don't mention this major breaking change in their
overlong CHANGES.md is crazy. Who reads the migration guide for an update
that's supposedly backward compatible? This will cause buffer overreads
left and right.
To wit, strlen(data) is a buffer overread, so use strnlen() instead.
While it is probably possible to rewrite tls_match_name() to cope with a
bag of bytes, it gets really hairy (I think it is already hairier than
all the yaks in Tibet combined). So use the lazy way and strndup(), then
we have a string and do not need to mess with this horrible byte bashing.
The other caller of tls_match_name() already passes a string.
As jsing points out, CBS_strndup() would be the right way to fix this.
ok kenjiro jsing
