blob: 7649bdf440407f198300defef068811f68e22bec (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
|
From f97a34bc7b390f185d544e21b0ef75db1275953e Mon Sep 17 00:00:00 2001
From: Theo Buehler <tb@openbsd.org>
Date: Sat, 22 Nov 2025 12:28:50 +0100
Subject: [PATCH] Use accessor for getting an ASN1_STRING's length
OpensSSL 4 has plans to make ASN1_STRING opaque [1]. hostcheck.c's code
mostly treats it as opaque, but accesses two lengths. This is API added
in OpenSSL 0.9.0, so I'm not sure we need a configure check.
WolfSSL only recently const corrected ASN1_STRING_length(), so maybe
there will be a need to cast away const.
[1]: https://github.com/openssl/openssl/issues/29117
--- a/lib/iolog/hostcheck.c
+++ b/lib/iolog/hostcheck.c
@@ -323,14 +323,14 @@
#endif
/* IPV4 address */
- if(current_name->d.iPAddress->length == 4) {
+ if(ASN1_STRING_length(current_name->d.iPAddress) == 4) {
if (inet_ntop(AF_INET, san_ip, san_ip_str, INET_ADDRSTRLEN) == NULL) {
result = MalformedCertificate;
break;
}
#if defined(HAVE_STRUCT_IN6_ADDR)
/* IPV6 address */
- } else if (current_name->d.iPAddress->length == 16) {
+ } else if (ASN1_STRING_length(current_name->d.iPAddress) == 16) {
if (inet_ntop(AF_INET6, san_ip, san_ip_str, INET6_ADDRSTRLEN) == NULL) {
result = MalformedCertificate;
break;
|
