https://bugs.openldap.org/show_bug.cgi?id=10641
Issue ID: 10641 Summary: Missing bound check on X.509 SAN string before wildcard matching Product: OpenLDAP Version: unspecified Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: backends Assignee: bugs@openldap.org Reporter: xfding@google.com Target Milestone: ---
In tls_o.c:1082, https://git.openldap.org/openldap/openldap/-/blob/master/libraries/libldap/t...
(sn[0] == '*') && (sn[1] == '.')
was tested before checking ( sl > 1 )
Similarly, on 1191, https://git.openldap.org/openldap/openldap/-/blob/master/libraries/libldap/t...
( cnstr[0] == '*' ) && ( cnstr[1] == '.' )
also has a missing bound check ( cnlen > 1 )
Note that OpenSSL would stop null-terminating strings by default in the major releases.