make_addressRange: unused bits in max must be zero

X509v3_addr_add_range() requires that min and max of an address range
have network encoding. In the RFC 3779 encoding of an actual address
range (as opposed to a prefix) as a SEQUENCE OF two ASN.1 BIT STRINGs,
the trailing one bits of the maximum become unused bits and therefore
must be DER encoded as zeroes. The DER encoder will clear them via i2d
but these trailing ones are annoying. Make a copy in which the unused
bits are cleared.

ok kenjiro

1 files changed, 23 insertions, 6 deletions

diff --git a/src/lib/libcrypto/x509/x509_addr.c b/src/lib/libcrypto/x509/x509_addr.c
index b4ee92a14b..ef2f7e0889 100644
--- a/src/lib/libcrypto/x509/x509_addr.c
+++ b/src/lib/libcrypto/x509/x509_addr.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: x509_addr.c,v 1.94 2025/05/10 05:54:39 tb Exp $ */
+/*      $OpenBSD: x509_addr.c,v 1.95 2026/04/26 17:58:58 tb Exp $ */
 /*
  * Contributed to the OpenSSL Project by the American Registry for
  * Internet Numbers ("ARIN").
@@ -961,18 +961,22 @@ trim_end_u8(CBS *cbs, uint8_t trim)
  * RFC 3779, 2.1.2.
  */
 static int
-make_addressRange(IPAddressOrRange **out_aor, uint8_t *min, uint8_t *max,
+make_addressRange(IPAddressOrRange **out_aor, uint8_t *min, uint8_t *in_max,
     uint32_t afi, int length)
 {
         IPAddressOrRange *aor = NULL;
         IPAddressRange *range;
         int prefix_len;
         CBS cbs;
+        CBB cbb;
+        uint8_t max[ADDR_RAW_BUF_LEN];
         size_t max_len, min_len;
         uint8_t unused_bits_min, unused_bits_max;
         uint8_t octet;
 
-        if (memcmp(min, max, length) > 0)
+        memset(&cbb, 0, sizeof(cbb));
+
+        if (memcmp(min, in_max, length) > 0)
                 goto err;
 
         /*
@@ -980,7 +984,7 @@ make_addressRange(IPAddressOrRange **out_aor, uint8_t *min, uint8_t *max,
          * must be encoded as a prefix.
          */
 
-        if ((prefix_len = range_should_be_prefix(min, max, length)) >= 0)
+        if ((prefix_len = range_should_be_prefix(min, in_max, length)) >= 0)
                 return make_addressPrefix(out_aor, min, afi, prefix_len);
 
         /*
@@ -1008,18 +1012,30 @@ make_addressRange(IPAddressOrRange **out_aor, uint8_t *min, uint8_t *max,
          * the trailing ones of the last octet.
          */
 
-        CBS_init(&cbs, max, length);
+        CBS_init(&cbs, in_max, length);
+        if (!CBB_init_fixed(&cbb, max, sizeof(max)))
+                goto err;
 
         if (!trim_end_u8(&cbs, 0xff))
                 goto err;
 
         unused_bits_max = 0;
         if ((max_len = CBS_len(&cbs)) > 0) {
-                if (!CBS_peek_last_u8(&cbs, &octet))
+                if (!CBS_get_last_u8(&cbs, &octet))
                         goto err;
 
                 unused_bits_max = count_trailing_zeroes(octet + 1);
+                octet &= 0xff << unused_bits_max;
+        }
+
+        if (!CBB_add_bytes(&cbb, CBS_data(&cbs), CBS_len(&cbs)))
+                goto err;
+        if (max_len > 0) {
+                if (!CBB_add_u8(&cbb, octet))
+                        goto err;
         }
+        if (!CBB_finish(&cbb, NULL, NULL))
+                goto err;
 
         /*
          * Populate IPAddressOrRange.
@@ -1048,6 +1064,7 @@ make_addressRange(IPAddressOrRange **out_aor, uint8_t *min, uint8_t *max,
         return 1;
 
  err:
+        CBB_cleanup(&cbb);
         IPAddressOrRange_free(aor);
         return 0;
 }