[openssl-commits] [openssl] OpenSSL_1_0_2-stable update

[Rich Salz]

The branch OpenSSL_1_0_2-stable has been updated
       via  2194b36979e84ba9c0ea84ba458cab51df6bceb8 (commit)
      from  e81a83657cc9a708ea25d4fcde6e0e9d04dd3ac5 (commit)


- Log -----------------------------------------------------------------
commit 2194b36979e84ba9c0ea84ba458cab51df6bceb8
Author: Rich Salz <rsalz at openssl.org>
Date:   Mon Jan 12 12:39:00 2015 -0500

    Allow multiple IDN xn-- indicators
    
    Update the X509v3 name parsing to allow multiple xn-- international
    domain name indicators in a name.  Previously, only allowed one at
    the beginning of a name, which was wrong.
    
    Reviewed-by: Viktor Dukhovni <viktor at openssl.org>
    (cherry picked from commit 31d1d3741f16bd80ec25f72dcdbf6bbdc5664374)

-----------------------------------------------------------------------

Summary of changes:
 crypto/x509v3/v3_utl.c |   35 ++++++++---------------------------
 1 file changed, 8 insertions(+), 27 deletions(-)

diff --git a/crypto/x509v3/v3_utl.c b/crypto/x509v3/v3_utl.c
index 10a7aa8..c9a6e79 100644
--- a/crypto/x509v3/v3_utl.c
+++ b/crypto/x509v3/v3_utl.c
@@ -752,7 +752,7 @@ static const unsigned char *valid_star(const unsigned char *p, size_t len,
 			{
 			int atstart = (state & LABEL_START);
 			int atend = (i == len - 1 || p[i+i] == '.');
-			/*
+			/*-
 			 * At most one wildcard per pattern.
 			 * No wildcards in IDNA labels.
 			 * No wildcards after the first label.
@@ -769,45 +769,26 @@ static const unsigned char *valid_star(const unsigned char *p, size_t len,
 			star = &p[i];
 			state &= ~LABEL_START;
 			}
-		else if ((state & LABEL_START) != 0)
-			{
-			/*
-			 * At the start of a label, skip any "xn--" and
-			 * remain in the LABEL_START state, but set the
-			 * IDNA label state
-			 */
-			if ((state & LABEL_IDNA) == 0 && len - i >= 4
-			    && strncasecmp((char *)&p[i], "xn--", 4) == 0)
-				{
-				i += 3;
-				state |= LABEL_IDNA;
-				continue;
-				}
-			/* Labels must start with a letter or digit */
-			state &= ~LABEL_START;
-			if (('a' <= p[i] && p[i] <= 'z')
-			    || ('A' <= p[i] && p[i] <= 'Z')
-			    || ('0' <= p[i] && p[i] <= '9'))
-				continue;
-			return NULL;
-			}
 		else if (('a' <= p[i] && p[i] <= 'z')
 			 || ('A' <= p[i] && p[i] <= 'Z')
 			 || ('0' <= p[i] && p[i] <= '9'))
 			{
-			state &= LABEL_IDNA;
-			continue;
+			if ((state & LABEL_START) != 0
+			    && len - i >= 4
+			    && strncasecmp((char *)&p[i], "xn--", 4) == 0)
+				state |= LABEL_IDNA;
+			state &= ~(LABEL_HYPHEN|LABEL_START);
 			}
 		else if (p[i] == '.')
 			{
-			if (state & (LABEL_HYPHEN | LABEL_START))
+			if ((state & (LABEL_HYPHEN | LABEL_START)) != 0)
 				return NULL;
 			state = LABEL_START;
 			++dots;
 			}
 		else if (p[i] == '-')
 			{
-			if (state & LABEL_HYPHEN)
+			if ((state & LABEL_HYPHEN) != 0)
 				return NULL;
 			state |= LABEL_HYPHEN;
 			}