[openssl/openssl] fce540: x509: avoid NULL memcmp argument in nc_dn()

  Branch: refs/heads/master
  Home:   https://github.com/openssl/openssl
  Commit: fce540139a7cf4de64d9ce8e17b9180778e12f4e
      https://github.com/openssl/openssl/commit/fce540139a7cf4de64d9ce8e17b9180778e12f4e
  Author: Mounir IDRASSI <[email protected]>
  Date:   2026-07-10 (Fri, 10 Jul 2026)

  Changed paths:
    M crypto/x509/v3_ncons.c

  Log Message:
  -----------
  x509: avoid NULL memcmp argument in nc_dn()

An empty directoryName constraint has canon_enc == NULL and
canon_enclen == 0. nc_dn() must not pass that pointer to
memcmp(), even with a zero length.

Return X509_V_OK before comparing an empty base Name. This preserves
current match semantics and avoids UBSan-visible undefined behaviour.

Fixes #31687
Fixes #31688

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Daniel Kubec <[email protected]>
MergeDate: Fri Jul 10 15:51:01 2026
(Merged from https://github.com/openssl/openssl/pull/31814)


  Commit: 7f4ac8022492a54aedd0100af4e624600d60c590
      https://github.com/openssl/openssl/commit/7f4ac8022492a54aedd0100af4e624600d60c590
  Author: Mounir IDRASSI <[email protected]>
  Date:   2026-07-10 (Fri, 10 Jul 2026)

  Changed paths:
    M test/x509_test.c

  Log Message:
  -----------
  test: cover empty directoryName name constraints

Add NAME_CONSTRAINTS_check() coverage for empty directoryName
subtrees in both excluded and permitted constraints.

The tests assert the existing results in ordinary builds and catch
the NULL memcmp() argument when run under UBSan.

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Daniel Kubec <[email protected]>
MergeDate: Fri Jul 10 15:51:03 2026
(Merged from https://github.com/openssl/openssl/pull/31814)


Compare: https://github.com/openssl/openssl/compare/b1393a04464e...7f4ac8022492

To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/master/b1393a-7f4ac8%40github.com.