https://bugs.openldap.org/show_bug.cgi?id=10641
--- Comment #1 from Howard Chu hyc@openldap.org --- (In reply to Xiangfei Ding from comment #0)
In tls_o.c:1082, https://git.openldap.org/openldap/openldap/-/blob/master/libraries/libldap/ tls_o.c?ref_type=heads&plain=1&blame=1#L1082
(sn[0] == '*') && (sn[1] == '.')was tested before checking ( sl > 1 )
The actual statement is if (domain && (sn[0] == '*') && (sn[1] == '.') && (len2 == sl-1) && !strncasecmp(domain, &sn[1], len2))
so the length is still being checked.
Similarly, on 1191, https://git.openldap.org/openldap/openldap/-/blob/master/libraries/libldap/ tls_o.c?ref_type=heads&plain=1&blame=1#L1191
( cnstr[0] == '*' ) && ( cnstr[1] == '.' )also has a missing bound check ( cnlen > 1 )
Likewise /* Is this a wildcard match? */ if ((dlen == cnlen-1) &&
The length checks are not missing, and a short string cannot match erroneously.
Note that OpenSSL would stop null-terminating strings by default in the major releases.
Makes no difference here.