From f2b4d86452c29e327a2c9cfa041b84c65e3d7a3b Mon Sep 17 00:00:00 2001 From: Paul Bakker Date: Wed, 20 Nov 2013 17:23:53 +0100 Subject: [PATCH] Fixed X.509 hostname comparison (with non-regular characters) In situations with 'weird' certificate names or hostnames (containing non-western allowed names) the check would falsely report a name or wildcard match. --- ChangeLog | 4 ++++ library/x509_crt.c | 8 ++++++-- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index 334d147fa..eca541c8f 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,5 +1,9 @@ PolarSSL ChangeLog (Sorted per branch, date) += PolarSSL 1.3 branch +Bugfix + * Fixed X.509 hostname comparison (with non-regular characters) + = PolarSSL 1.3.2 released on 2013-11-04 Features * PK tests added to test framework diff --git a/library/x509_crt.c b/library/x509_crt.c index 6a127b267..6382c5377 100644 --- a/library/x509_crt.c +++ b/library/x509_crt.c @@ -1273,11 +1273,15 @@ static int x509_name_cmp( const void *s1, const void *s2, size_t len ) { diff = n1[i] ^ n2[i]; - if( ( n1[i] >= 'a' || n1[i] <= 'z' ) && ( diff == 0 || diff == 32 ) ) + if( diff == 0 ) continue; - if( ( n1[i] >= 'A' || n1[i] <= 'Z' ) && ( diff == 0 || diff == 32 ) ) + if( diff == 32 && + ( ( n1[i] >= 'a' && n1[i] <= 'z' ) || + ( n1[i] >= 'A' && n1[i] <= 'Z' ) ) ) + { continue; + } return( 1 ); }