mirror of
https://github.com/wolfSSL/wolfssl.git
synced 2026-08-11 09:41:22 +02:00
Tobias Frauenschläger
96fb284398
wolfSSL_X509_check_host takes an explicit length and its own validation accepts a buffer with no NUL terminator, since only an embedded NUL is rejected and a trailing one is merely stripped when present. The iPAddress check then called CheckIPAddr, which drops the length and measures the buffer with XSTRLEN, reading past the end of a caller supplied buffer that is length delimited rather than terminated. This ran on every call, not only when checking an IP address, and is compiled in whenever WOLFSSL_IP_ALT_NAME is defined, which OPENSSL_ALL and WOLFSSL_QT enable. Call CheckHostName directly with the caller's length and the IP flag set. That is what CheckIPAddr does internally, minus the length being recomputed. Behaviour is unchanged for NUL terminated input, because the normalization above already leaves chklen equal to the string length in that case. It also fixes a matching bug, since a length delimited IP address sitting in a longer buffer no longer fails to match an iPAddress entry. Add a regression test covering an interior slice of a longer buffer and a buffer sized exactly to the name with no terminator. Fixes F-7248.
Before creating any new configure files (.conf) read the CONF_FILES_README.md