diff options
-rw-r--r-- | src/lib/libcrypto/cert.pem | 45 | ||||
-rw-r--r-- | src/lib/libcrypto/x509/x509_constraints.c | 14 |
2 files changed, 10 insertions, 49 deletions
diff --git a/src/lib/libcrypto/cert.pem b/src/lib/libcrypto/cert.pem index 104049e9ef..0e50fe639a 100644 --- a/src/lib/libcrypto/cert.pem +++ b/src/lib/libcrypto/cert.pem | |||
@@ -1,4 +1,4 @@ | |||
1 | # $OpenBSD: cert.pem,v 1.23 2021/06/11 11:40:35 sthen Exp $ | 1 | # $OpenBSD: cert.pem,v 1.24 2021/09/30 18:16:11 deraadt Exp $ |
2 | ### /C=ES/CN=Autoridad de Certificacion Firmaprofesional CIF A62634068 | 2 | ### /C=ES/CN=Autoridad de Certificacion Firmaprofesional CIF A62634068 |
3 | 3 | ||
4 | === /C=ES/CN=Autoridad de Certificacion Firmaprofesional CIF A62634068 | 4 | === /C=ES/CN=Autoridad de Certificacion Firmaprofesional CIF A62634068 |
@@ -1821,49 +1821,6 @@ r/OSmbaz5mEP0oUA51Aa5BuVnRmhuZyxm7EAHu/QD09CbMkKvO5D+jpxpchNJqU1 | |||
1821 | gKDWHrO8Dw9TdSmq6hN35N6MgSGtBxBHEa2HPQfRdbzP82Z+ | 1821 | gKDWHrO8Dw9TdSmq6hN35N6MgSGtBxBHEa2HPQfRdbzP82Z+ |
1822 | -----END CERTIFICATE----- | 1822 | -----END CERTIFICATE----- |
1823 | 1823 | ||
1824 | ### Digital Signature Trust Co. | ||
1825 | |||
1826 | === /O=Digital Signature Trust Co./CN=DST Root CA X3 | ||
1827 | Certificate: | ||
1828 | Data: | ||
1829 | Version: 3 (0x2) | ||
1830 | Serial Number: | ||
1831 | 44:af:b0:80:d6:a3:27:ba:89:30:39:86:2e:f8:40:6b | ||
1832 | Signature Algorithm: sha1WithRSAEncryption | ||
1833 | Validity | ||
1834 | Not Before: Sep 30 21:12:19 2000 GMT | ||
1835 | Not After : Sep 30 14:01:15 2021 GMT | ||
1836 | Subject: O=Digital Signature Trust Co., CN=DST Root CA X3 | ||
1837 | X509v3 extensions: | ||
1838 | X509v3 Basic Constraints: critical | ||
1839 | CA:TRUE | ||
1840 | X509v3 Key Usage: critical | ||
1841 | Certificate Sign, CRL Sign | ||
1842 | X509v3 Subject Key Identifier: | ||
1843 | C4:A7:B1:A4:7B:2C:71:FA:DB:E1:4B:90:75:FF:C4:15:60:85:89:10 | ||
1844 | SHA1 Fingerprint=DA:C9:02:4F:54:D8:F6:DF:94:93:5F:B1:73:26:38:CA:6A:D7:7C:13 | ||
1845 | SHA256 Fingerprint=06:87:26:03:31:A7:24:03:D9:09:F1:05:E6:9B:CF:0D:32:E1:BD:24:93:FF:C6:D9:20:6D:11:BC:D6:77:07:39 | ||
1846 | -----BEGIN CERTIFICATE----- | ||
1847 | MIIDSjCCAjKgAwIBAgIQRK+wgNajJ7qJMDmGLvhAazANBgkqhkiG9w0BAQUFADA/ | ||
1848 | MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT | ||
1849 | DkRTVCBSb290IENBIFgzMB4XDTAwMDkzMDIxMTIxOVoXDTIxMDkzMDE0MDExNVow | ||
1850 | PzEkMCIGA1UEChMbRGlnaXRhbCBTaWduYXR1cmUgVHJ1c3QgQ28uMRcwFQYDVQQD | ||
1851 | Ew5EU1QgUm9vdCBDQSBYMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB | ||
1852 | AN+v6ZdQCINXtMxiZfaQguzH0yxrMMpb7NnDfcdAwRgUi+DoM3ZJKuM/IUmTrE4O | ||
1853 | rz5Iy2Xu/NMhD2XSKtkyj4zl93ewEnu1lcCJo6m67XMuegwGMoOifooUMM0RoOEq | ||
1854 | OLl5CjH9UL2AZd+3UWODyOKIYepLYYHsUmu5ouJLGiifSKOeDNoJjj4XLh7dIN9b | ||
1855 | xiqKqy69cK3FCxolkHRyxXtqqzTWMIn/5WgTe1QLyNau7Fqckh49ZLOMxt+/yUFw | ||
1856 | 7BZy1SbsOFU5Q9D8/RhcQPGX69Wam40dutolucbY38EVAjqr2m7xPi71XAicPNaD | ||
1857 | aeQQmxkqtilX4+U9m5/wAl0CAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNV | ||
1858 | HQ8BAf8EBAMCAQYwHQYDVR0OBBYEFMSnsaR7LHH62+FLkHX/xBVghYkQMA0GCSqG | ||
1859 | SIb3DQEBBQUAA4IBAQCjGiybFwBcqR7uKGY3Or+Dxz9LwwmglSBd49lZRNI+DT69 | ||
1860 | ikugdB/OEIKcdBodfpga3csTS7MgROSR6cz8faXbauX+5v3gTt23ADq1cEmv8uXr | ||
1861 | AvHRAosZy5Q6XkjEGB5YGV8eAlrwDPGxrancWYaLbumR9YbK+rlmM6pZW87ipxZz | ||
1862 | R8srzJmwN0jP41ZL9c8PDHIyh8bwRLtTcm1D9SZImlJnt1ir/md2cXjbDaJWFBM5 | ||
1863 | JDGFoqgCWjBH4d1QB7wCCZAA62RjYJsWvIjJEubSfZGL+T0yjWW06XyxV3bqxbYo | ||
1864 | Ob8VZRzI9neWagqNdwvYkQsEjgfbKbYK7p2CNTUQ | ||
1865 | -----END CERTIFICATE----- | ||
1866 | |||
1867 | ### Disig a.s. | 1824 | ### Disig a.s. |
1868 | 1825 | ||
1869 | === /C=SK/L=Bratislava/O=Disig a.s./CN=CA Disig Root R2 | 1826 | === /C=SK/L=Bratislava/O=Disig a.s./CN=CA Disig Root R2 |
diff --git a/src/lib/libcrypto/x509/x509_constraints.c b/src/lib/libcrypto/x509/x509_constraints.c index fade58c620..db33bf1aa4 100644 --- a/src/lib/libcrypto/x509/x509_constraints.c +++ b/src/lib/libcrypto/x509/x509_constraints.c | |||
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: x509_constraints.c,v 1.16 2021/04/27 03:35:29 beck Exp $ */ | 1 | /* $OpenBSD: x509_constraints.c,v 1.17 2021/09/23 15:49:48 jsing Exp $ */ |
2 | /* | 2 | /* |
3 | * Copyright (c) 2020 Bob Beck <beck@openbsd.org> | 3 | * Copyright (c) 2020 Bob Beck <beck@openbsd.org> |
4 | * | 4 | * |
@@ -339,16 +339,16 @@ x509_constraints_parse_mailbox(uint8_t *candidate, size_t len, | |||
339 | if (c == '.') | 339 | if (c == '.') |
340 | goto bad; | 340 | goto bad; |
341 | } | 341 | } |
342 | if (wi > DOMAIN_PART_MAX_LEN) | ||
343 | goto bad; | ||
344 | if (accept) { | 342 | if (accept) { |
343 | if (wi >= DOMAIN_PART_MAX_LEN) | ||
344 | goto bad; | ||
345 | working[wi++] = c; | 345 | working[wi++] = c; |
346 | accept = 0; | 346 | accept = 0; |
347 | continue; | 347 | continue; |
348 | } | 348 | } |
349 | if (candidate_local != NULL) { | 349 | if (candidate_local != NULL) { |
350 | /* We are looking for the domain part */ | 350 | /* We are looking for the domain part */ |
351 | if (wi > DOMAIN_PART_MAX_LEN) | 351 | if (wi >= DOMAIN_PART_MAX_LEN) |
352 | goto bad; | 352 | goto bad; |
353 | working[wi++] = c; | 353 | working[wi++] = c; |
354 | if (i == len - 1) { | 354 | if (i == len - 1) { |
@@ -363,7 +363,7 @@ x509_constraints_parse_mailbox(uint8_t *candidate, size_t len, | |||
363 | continue; | 363 | continue; |
364 | } | 364 | } |
365 | /* We are looking for the local part */ | 365 | /* We are looking for the local part */ |
366 | if (wi > LOCAL_PART_MAX_LEN) | 366 | if (wi >= LOCAL_PART_MAX_LEN) |
367 | break; | 367 | break; |
368 | 368 | ||
369 | if (quoted) { | 369 | if (quoted) { |
@@ -383,6 +383,8 @@ x509_constraints_parse_mailbox(uint8_t *candidate, size_t len, | |||
383 | */ | 383 | */ |
384 | if (c == 9) | 384 | if (c == 9) |
385 | goto bad; | 385 | goto bad; |
386 | if (wi >= LOCAL_PART_MAX_LEN) | ||
387 | goto bad; | ||
386 | working[wi++] = c; | 388 | working[wi++] = c; |
387 | continue; /* all's good inside our quoted string */ | 389 | continue; /* all's good inside our quoted string */ |
388 | } | 390 | } |
@@ -412,6 +414,8 @@ x509_constraints_parse_mailbox(uint8_t *candidate, size_t len, | |||
412 | } | 414 | } |
413 | if (!local_part_ok(c)) | 415 | if (!local_part_ok(c)) |
414 | goto bad; | 416 | goto bad; |
417 | if (wi >= LOCAL_PART_MAX_LEN) | ||
418 | goto bad; | ||
415 | working[wi++] = c; | 419 | working[wi++] = c; |
416 | } | 420 | } |
417 | if (candidate_local == NULL || candidate_domain == NULL) | 421 | if (candidate_local == NULL || candidate_domain == NULL) |