(tomcat-native) branch 1.3.x updated: Fix a potential crash when negotiating ALPN

This is an automated email from the ASF dual-hosted git repository.

markt-asf pushed a commit to branch 1.3.x
in repository https://gitbox.apache.org/repos/asf/tomcat-native.git


The following commit(s) were added to refs/heads/1.3.x by this push:
     new cd4db078d Fix a potential crash when negotiating ALPN
cd4db078d is described below

commit cd4db078d913545cce83a9d5fa00df1b3d4e8629
Author: Mark Thomas <[email protected]>
AuthorDate: Wed Aug 26 13:21:11 2026 +0100

    Fix a potential crash when negotiating ALPN
---
 native/src/sslutils.c             | 2 +-
 xdocs/miscellaneous/changelog.xml | 3 +++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/native/src/sslutils.c b/native/src/sslutils.c
index 84616edbb..7a9fd0fef 100644
--- a/native/src/sslutils.c
+++ b/native/src/sslutils.c
@@ -492,7 +492,7 @@ int select_next_proto(SSL *ssl, const unsigned char **out, unsigned char *outlen
         }
 
         // increment len and pointers.
-        i += target_proto_len;
+        i += 1 + target_proto_len;
         supported_protos += target_proto_len;
     }
 
diff --git a/xdocs/miscellaneous/changelog.xml b/xdocs/miscellaneous/changelog.xml
index 662387bef..e70d40bc6 100644
--- a/xdocs/miscellaneous/changelog.xml
+++ b/xdocs/miscellaneous/changelog.xml
@@ -38,6 +38,9 @@
       allow building with OpenSSL 4.0.x. ERR_remove_thread_state() is a no-op
       in OpenSSL 1.1+ and got removed in OpenSSL 4. (rjung)
     </scode>
+    <fix>
+      Fix a potential crash when negotiating ALPN. (markt)
+    </fix>
   </changelog>
 </section>
 <section name="1.3.8" rtext="2026-06-15">