Add a length check before NUL-terminating target. From Jonas Termansen.

ok jsing

1 files changed, 5 insertions, 1 deletions

diff --git a/src/usr.bin/openssl/certhash.c b/src/usr.bin/openssl/certhash.c
index 31c4899fae..a4417a2b26 100644
--- a/src/usr.bin/openssl/certhash.c
+++ b/src/usr.bin/openssl/certhash.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: certhash.c,v 1.18 2021/08/28 08:16:39 tb Exp $ */
+/*      $OpenBSD: certhash.c,v 1.19 2021/10/23 08:13:48 tb Exp $ */
 /*
  * Copyright (c) 2014, 2015 Joel Sing <jsing@openbsd.org>
  *
@@ -490,6 +490,10 @@ certhash_link(struct dirent *dep, struct hashinfo **links)
                 fprintf(stderr, "failed to readlink %s\n", dep->d_name);
                 return (-1);
         }
+        if (n >= sizeof(target) - 1) {
+                fprintf(stderr, "symbolic link is too long %s\n", dep->d_name);
+                return (-1);
+        }
         target[n] = '\0';
 
         hi = hashinfo_from_linkname(dep->d_name, target);