[openssl/openssl] ef8b52: x509: avoid NULL memcmp argument in nc_dn()

  Branch: refs/heads/openssl-4.0
  Home:   https://github.com/openssl/openssl
  Commit: ef8b52c3c305a70bc330ffd07c956f6d1c89f8cb
      https://github.com/openssl/openssl/commit/ef8b52c3c305a70bc330ffd07c956f6d1c89f8cb
  Author: Mounir IDRASSI <[email protected]>
  Date:   2026-07-10 (Fri, 10 Jul 2026)

  Changed paths:
    M crypto/x509/v3_ncons.c

  Log Message:
  -----------
  x509: avoid NULL memcmp argument in nc_dn()

An empty directoryName constraint has canon_enc == NULL and
canon_enclen == 0. nc_dn() must not pass that pointer to
memcmp(), even with a zero length.

Return X509_V_OK before comparing an empty base Name. This preserves
current match semantics and avoids UBSan-visible undefined behaviour.

Fixes #31687
Fixes #31688

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Daniel Kubec <[email protected]>
MergeDate: Fri Jul 10 15:51:01 2026
(Merged from https://github.com/openssl/openssl/pull/31814)

(cherry picked from commit fce540139a7cf4de64d9ce8e17b9180778e12f4e)


  Commit: 90de89a7c5f19946ea62651dc588ed12bc3fc03d
      https://github.com/openssl/openssl/commit/90de89a7c5f19946ea62651dc588ed12bc3fc03d
  Author: Mounir IDRASSI <[email protected]>
  Date:   2026-07-10 (Fri, 10 Jul 2026)

  Changed paths:
    M test/x509_test.c

  Log Message:
  -----------
  test: cover empty directoryName name constraints

Add NAME_CONSTRAINTS_check() coverage for empty directoryName
subtrees in both excluded and permitted constraints.

The tests assert the existing results in ordinary builds and catch
the NULL memcmp() argument when run under UBSan.

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Daniel Kubec <[email protected]>
MergeDate: Fri Jul 10 15:51:03 2026
(Merged from https://github.com/openssl/openssl/pull/31814)

(cherry picked from commit 7f4ac8022492a54aedd0100af4e624600d60c590)


Compare: https://github.com/openssl/openssl/compare/2c2b50456301...90de89a7c5f1

To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/openssl-4.0/2c2b50-90de89%40github.com.