diff options
| author | Bob Beck <[email protected]> | 2026-08-05 17:39:37 +0200 |
|---|---|---|
| committer | Tomas Mraz <[email protected]> | 2026-08-27 15:52:18 +0200 |
| commit | 81e0cf8ea3d2c29073291ead904203634778b32a (patch) | |
| tree | a6dc0275857f63369ef7119ce49c18ac9ccc6798 | |
| parent | Don't treat a CRL distribution point URI as a NUL terminated string (diff) | |
| download | openssl-81e0cf8ea3d2c29073291ead904203634778b32a.tar.gz openssl-81e0cf8ea3d2c29073291ead904203634778b32a.zip | |
Don't read an ASN1_STRING data raw and assume it's 0 byte terminated
Fix latent app bug in policy error diagnostics.
Fixes: #32176
Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Andrew Dinh <[email protected]>
Reviewed-by: Nikola Pajkovsky <[email protected]>
Merge-date: Thu Aug 27 13:52:39 2026
Merged-from: https://github.com/openssl/openssl/pull/32178
| -rw-r--r-- | apps/ca.c | 16 |
1 files changed, 12 insertions, 4 deletions
diff --git a/apps/ca.c b/apps/ca.c index ff7d1cdf792..1c42a2dfe03 100644 --- a/apps/ca.c +++ b/apps/ca.c @@ -1628,10 +1628,18 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, if (j < 0) { BIO_printf(bio_err, "The %s field is different between\n" - "CA certificate (%s) and the request (%s)\n", - cv->name, - ((str2 == NULL) ? "NULL" : (char *)ASN1_STRING_get0_data(str2)), - ((str == NULL) ? "NULL" : (char *)ASN1_STRING_get0_data(str))); + "CA certificate (", + cv->name); + if (str2 == NULL) + BIO_puts(bio_err, "NULL"); + else + ASN1_STRING_print_ex(bio_err, str2, ASN1_STRFLGS_RFC2253); + BIO_puts(bio_err, ") and the request ("); + if (str == NULL) + BIO_puts(bio_err, "NULL"); + else + ASN1_STRING_print_ex(bio_err, str, ASN1_STRFLGS_RFC2253); + BIO_puts(bio_err, ")\n"); goto end; } } else { |