From: Dr. Stephen Henson <steve@openssl.org>
Date: Sat, 30 May 2009 18:10:59 +0000 (+0000)
Subject: Ensure canonical encodings of X509_NAME structures are valid.
X-Git-Tag: OpenSSL_1_0_0-beta3~65
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=f16411ccfd2849bf209d60d88eb5d69f2e63b211;p=oweals%2Fopenssl.git

Ensure canonical encodings of X509_NAME structures are valid.
---

diff --git a/crypto/x509/x509_cmp.c b/crypto/x509/x509_cmp.c
index 306d4b2d73..2e444f2848 100644
--- a/crypto/x509/x509_cmp.c
+++ b/crypto/x509/x509_cmp.c
@@ -173,16 +173,16 @@ int X509_NAME_cmp(const X509_NAME *a, const X509_NAME *b)
 	{
 	int ret;
 
-	/* Ensure canonical encoding is present */
+	/* Ensure canonical encoding is present and up to date */
 
-	if (!a->canon_enc)
+	if (!a->canon_enc || a->modified)
 		{
 		ret = i2d_X509_NAME((X509_NAME *)a, NULL);
 		if (ret < 0)
 			return -2;
 		}
 
-	if (!b->canon_enc)
+	if (!b->canon_enc || b->modified)
 		{
 		ret = i2d_X509_NAME((X509_NAME *)b, NULL);
 		if (ret < 0)
diff --git a/crypto/x509v3/v3_ncons.c b/crypto/x509v3/v3_ncons.c
index ce5a8f6efc..689df46acd 100644
--- a/crypto/x509v3/v3_ncons.c
+++ b/crypto/x509v3/v3_ncons.c
@@ -376,6 +376,11 @@ static int nc_match_single(GENERAL_NAME *gen, GENERAL_NAME *base)
 
 static int nc_dn(X509_NAME *nm, X509_NAME *base)
 	{
+	/* Ensure canonical encodings are up to date.  */
+	if (nm->modified && i2d_X509_NAME(nm, NULL) < 0)
+		return X509_V_ERR_OUT_OF_MEM;
+	if (base->modified && i2d_X509_NAME(base, NULL) < 0)
+		return X509_V_ERR_OUT_OF_MEM;
 	if (base->canon_enclen > nm->canon_enclen)
 		return X509_V_ERR_PERMITTED_VIOLATION;
 	if (memcmp(base->canon_enc, nm->canon_enc, base->canon_enclen))