CVS: cvs.openbsd.org: src

CVSROOT:	/cvs
Module name:	src
Changes by:	[email protected]	2026/07/14 09:52:52

Modified files:
	lib/libcrypto/x509: x509_constraints.c 

Log message:
Fix X.509 constraints URI host parsing.

An authority in a URI is only terminated by a slash, question mark or hash,
however the current code also included colons. This allows a specically
crafted userinfo to bypass name constraints host checks. Additionally, IPv6
literals may only be specified when enclosed with square brackets, which is
not enforced.

Rewrite parts of the host and IP parsing code to be more strict, fixing
both of these issues in the process.

Thanks to Jack Lloyd for reporting the userinfo bypass.

ok tb@