[nginx] SSL: explicit handling of empty names.
Maxim Dounin
mdounin at mdounin.ru
Wed Apr 23 16:32:08 UTC 2014
details: http://hg.nginx.org/nginx/rev/cac82b9b3499
branches:
changeset: 5669:cac82b9b3499
user: Maxim Dounin <mdounin at mdounin.ru>
date: Wed Apr 23 20:31:31 2014 +0400
description:
SSL: explicit handling of empty names.
X509_check_host() can't handle non null-terminated names with zero length,
so make sure to fail before calling it.
diffstat:
src/event/ngx_event_openssl.c | 4 ++++
1 files changed, 4 insertions(+), 0 deletions(-)
diffs (14 lines):
diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
--- a/src/event/ngx_event_openssl.c
+++ b/src/event/ngx_event_openssl.c
@@ -2504,6 +2504,10 @@ ngx_ssl_check_host(ngx_connection_t *c,
/* X509_check_host() is only available in OpenSSL 1.0.2+ */
+ if (name->len == 0) {
+ goto failed;
+ }
+
if (X509_check_host(cert, name->data, name->len, 0) != 1) {
ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
"X509_check_host(): no match");
More information about the nginx-devel
mailing list