[openssl/openssl] c84757: x509: avoid NULL memcmp argument in nc_dn()

  Branch: refs/heads/openssl-3.0
  Home:   https://github.com/openssl/openssl
  Commit: c8475727165cb782a379781b530ef61e6f2abe2c
      https://github.com/openssl/openssl/commit/c8475727165cb782a379781b530ef61e6f2abe2c
  Author: Mounir IDRASSI <[email protected]>
  Date:   2026-07-20 (Mon, 20 Jul 2026)

  Changed paths:
    M crypto/x509/v3_ncons.c

  Log Message:
  -----------
  x509: avoid NULL memcmp argument in nc_dn()

An empty directoryName constraint has canon_enc == NULL and
canon_enclen == 0. nc_dn() must not pass that pointer to
memcmp(), even with a zero length.

Return X509_V_OK before comparing an empty base Name. This preserves
current match semantics and avoids UBSan-visible undefined behaviour.

Fixes #31687
Fixes #31688

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Daniel Kubec <[email protected]>
MergeDate: Fri Jul 10 15:51:01 2026

(cherry picked from commit fce540139a7cf4de64d9ce8e17b9180778e12f4e)

Reviewed-by: Frederik Wedel-Heinen <[email protected]>
Reviewed-by: Paul Yang <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/31923)


  Commit: 9976cfad448ec6e62cb412aab92d25b0d4b8ca96
      https://github.com/openssl/openssl/commit/9976cfad448ec6e62cb412aab92d25b0d4b8ca96
  Author: Mounir IDRASSI <[email protected]>
  Date:   2026-07-20 (Mon, 20 Jul 2026)

  Changed paths:
    M test/v3ext.c

  Log Message:
  -----------
  test: cover empty directoryName name constraints

Add NAME_CONSTRAINTS_check() coverage for empty directoryName
subtrees in both excluded and permitted constraints.

The tests assert the existing results in ordinary builds and catch
the NULL memcmp() argument when run under UBSan.

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Daniel Kubec <[email protected]>
MergeDate: Fri Jul 10 15:51:03 2026

(cherry picked from commit 7f4ac8022492a54aedd0100af4e624600d60c590)

Reviewed-by: Frederik Wedel-Heinen <[email protected]>
Reviewed-by: Paul Yang <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/31923)


Compare: https://github.com/openssl/openssl/compare/a990de3cc436...9976cfad448e

To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/openssl-3.0/a990de-9976cf%40github.com.