1 files changed, 9 insertions, 5 deletions

diff --git a/src/lib/libcrypto/x509/x509_constraints.c b/src/lib/libcrypto/x509/x509_constraints.c
index fade58c620..db33bf1aa4 100644
--- a/src/lib/libcrypto/x509/x509_constraints.c
+++ b/src/lib/libcrypto/x509/x509_constraints.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_constraints.c,v 1.16 2021/04/27 03:35:29 beck Exp $ */
+/* $OpenBSD: x509_constraints.c,v 1.17 2021/09/23 15:49:48 jsing Exp $ */
 /*
  * Copyright (c) 2020 Bob Beck <beck@openbsd.org>
  *
@@ -339,16 +339,16 @@ x509_constraints_parse_mailbox(uint8_t *candidate, size_t len,
                         if (c == '.')
                                 goto bad;
                 }
-                if (wi > DOMAIN_PART_MAX_LEN)
-                        goto bad;
                 if (accept) {
+                        if (wi >= DOMAIN_PART_MAX_LEN)
+                                goto bad;
                         working[wi++] = c;
                         accept = 0;
                         continue;
                 }
                 if (candidate_local != NULL) {
                         /* We are looking for the domain part */
-                        if (wi > DOMAIN_PART_MAX_LEN)
+                        if (wi >= DOMAIN_PART_MAX_LEN)
                                 goto bad;
                         working[wi++] = c;
                         if (i == len - 1) {
@@ -363,7 +363,7 @@ x509_constraints_parse_mailbox(uint8_t *candidate, size_t len,
                         continue;
                 }
                 /* We are looking for the local part */
-                if (wi > LOCAL_PART_MAX_LEN)
+                if (wi >= LOCAL_PART_MAX_LEN)
                         break;
 
                 if (quoted) {
@@ -383,6 +383,8 @@ x509_constraints_parse_mailbox(uint8_t *candidate, size_t len,
                          */
                         if (c == 9)
                                 goto bad;
+                        if (wi >= LOCAL_PART_MAX_LEN)
+                                goto bad;
                         working[wi++] = c;
                         continue; /* all's good inside our quoted string */
                 }
@@ -412,6 +414,8 @@ x509_constraints_parse_mailbox(uint8_t *candidate, size_t len,
                 }
                 if (!local_part_ok(c))
                         goto bad;
+                if (wi >= LOCAL_PART_MAX_LEN)
+                        goto bad;
                 working[wi++] = c;
         }
         if (candidate_local == NULL || candidate_domain == NULL)