[PATCH 2/3] imap-send: don't expect an ASN1_STRING to be NUL-terminated
From: Beat Bolli <hidden>
Date: 2026-09-07 21:23:04
Subsystem:
the rest · Maintainer:
Linus Torvalds
As highlighted by a recent OpenSSL commit[1], ASN1_STRINGs were never documented to be terminated by a NUL byte, but our code treats the pattern as such in the strcasecmp() call. Make a NUL-terminated copy to avoid Undefined Behavior. [1]: https://github.com/openssl/openssl/commit/4b581a4666c3e470a01a7323801b2ba8ccfa478c (Add a migration entry for ASN1_STRINGs, 2026-08-06) Signed-off-by: Beat Bolli <redacted> --- imap-send.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
diff --git a/imap-send.c b/imap-send.c
index 977d78005c..9a807cdde8 100644
--- a/imap-send.c
+++ b/imap-send.c@@ -226,20 +226,25 @@ static int ssl_socket_connect(struct imap_socket *sock UNUSED, static int host_matches(const char *host, const ASN1_STRING *asn1_str) { - const char *pattern = (const char *)ASN1_STRING_get0_data(asn1_str); + int ret = 0; + size_t len = ASN1_STRING_get_length(asn1_str); + char *pattern = xmemdupz(ASN1_STRING_get0_data(asn1_str), len); /* embedded NUL characters may open a security hole */ - if (memchr(pattern, '\0', ASN1_STRING_get_length(asn1_str))) - return 0; + if (memchr(pattern, '\0', len)) + goto out; if (pattern[0] == '*' && pattern[1] == '.') { pattern += 2; if (!(host = strchr(host, '.'))) - return 0; + goto out; host++; } - return *host && *pattern && !strcasecmp(host, pattern); + ret = *host && *pattern && !strcasecmp(host, pattern); +out: + free(pattern); + return ret; } static int verify_hostname(X509 *cert, const char *hostname)
--
2.53.0