From cfbc10fb327cf8535d6e9b402d1d03140d23d753 Mon Sep 17 00:00:00 2001 From: Viktor Dukhovni Date: Fri, 13 Jun 2014 23:45:56 -0400 Subject: [PATCH] Enforce _X509_CHECK_FLAG_DOT_SUBDOMAINS internal-only (cherry picked from commit d435e23959f1c2cb4feadbfba9ad884c59f37db9) --- crypto/x509v3/v3_utl.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/crypto/x509v3/v3_utl.c b/crypto/x509v3/v3_utl.c index 004a1339ea..6e91ac9816 100644 --- a/crypto/x509v3/v3_utl.c +++ b/crypto/x509v3/v3_utl.c @@ -584,13 +584,9 @@ static void skip_prefix(const unsigned char **p, size_t *plen, * If subject starts with a leading '.' followed by more octets, and * pattern is longer, compare just an equal-length suffix with the * full subject (starting at the '.'), provided the prefix contains - * no NULs. (We check again that subject starts with '.' and - * contains at least one subsequent character, just in case the - * internal _X509_CHECK_FLAG_DOT_SUBDOMAINS flag was erroneously - * set by the user). + * no NULs. */ - if ((flags & _X509_CHECK_FLAG_DOT_SUBDOMAINS) == 0 || - subject_len <= 1 || subject[0] != '.') + if ((flags & _X509_CHECK_FLAG_DOT_SUBDOMAINS) == 0) return; while (pattern_len > subject_len && *pattern) @@ -895,6 +891,9 @@ static int do_x509_check(X509 *x, const unsigned char *chk, size_t chklen, int alt_type; int san_present = 0; equal_fn equal; + + /* See below, this flag is internal-only */ + flags &= ~_X509_CHECK_FLAG_DOT_SUBDOMAINS; if (check_type == GEN_EMAIL) { cnid = NID_pkcs9_emailAddress; -- 2.25.1