Handle XMPP SANs properly.

Reported by Howard Chu <hyc@symas.com> in
<https://savannah.gnu.org/support/?106975>.

diff --git a/lib/x509/x509.c b/lib/x509/x509.c
index 2fa3c6b9c43f6b6b26e58a0489f6a5ed86cf0c8c..a65626b9b358b586900af10b3ebafccaaae867cb 100644 (file)
--- a/lib/x509/x509.c
+++ b/lib/x509/x509.c
@@ -1012,6 +1012,7 @@ _gnutls_parse_general_name (ASN1_TYPE src, const char *src_name,
          if (len > strlen (XMPP_OID) && strcmp (oid, XMPP_OID) == 0)
            {
              ASN1_TYPE c2 = ASN1_TYPE_EMPTY;
+             size_t orig_name_size = *name_size;
 
              result = asn1_create_element
                (_gnutls_get_pkix (), "PKIX1.XmppAddr", &c2);
@@ -1029,15 +1030,27 @@ _gnutls_parse_general_name (ASN1_TYPE src, const char *src_name,
                  return _gnutls_asn2err (result);
                }
 
+             len = *name_size;
              result = asn1_read_value (c2, "", name, &len);
-             *name_size = len;
              if (result != ASN1_SUCCESS)
                {
                  gnutls_assert ();
                  asn1_delete_structure (&c2);
+                 *name_size = len + 1;
                  return _gnutls_asn2err (result);
                }
              asn1_delete_structure (&c2);
+
+             if (len + 1 > orig_name_size)
+               {
+                 gnutls_assert ();
+                 *name_size = len + 1;
+                 return GNUTLS_E_SHORT_MEMORY_BUFFER;
+               }
+
+             *name_size = len;
+             /* null terminate it */
+             ((char *) name)[*name_size] = 0;
            }
        }
     }