Commit 7241a4c7 authored by Viktor Dukhovni's avatar Viktor Dukhovni Committed by Dr. Stephen Henson
Browse files

Enforce _X509_CHECK_FLAG_DOT_SUBDOMAINS internal-only

parent 3b77f017

crypto/x509v3/v3_utl.c

+5 −6
Original line number Diff line number Diff line
@@ -584,13 +584,9 @@ static void skip_prefix(const unsigned char **p, size_t *plen, 
	 * If subject starts with a leading '.' followed by more octets, and

	 * pattern is longer, compare just an equal-length suffix with the

	 * full subject (starting at the '.'), provided the prefix contains

	 * no NULs.  (We check again that subject starts with '.' and

	 * contains at least one subsequent character, just in case the

	 * internal _X509_CHECK_FLAG_DOT_SUBDOMAINS flag was erroneously

	 * set by the user).

	 * no NULs.

	 */

	if ((flags & _X509_CHECK_FLAG_DOT_SUBDOMAINS) == 0 ||

	    subject_len <= 1 || subject[0] != '.')

	if ((flags & _X509_CHECK_FLAG_DOT_SUBDOMAINS) == 0)

		return;



	while (pattern_len > subject_len && *pattern)
@@ -895,6 +891,9 @@ static int do_x509_check(X509 *x, const unsigned char *chk, size_t chklen, 
	int alt_type;

	int san_present = 0;

	equal_fn equal;



	/* See below, this flag is internal-only */

	flags &= ~_X509_CHECK_FLAG_DOT_SUBDOMAINS;

	if (check_type == GEN_EMAIL)

		{

		cnid = NID_pkcs9_emailAddress;