(parse_pem_ca_mem): Handle reads beyond first certificate properly.

Reported by Dennis Vshivkov <walrus@amur.ru> in
<http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=333050>.

diff --git a/lib/gnutls_x509.c b/lib/gnutls_x509.c
index 5172cfb033d64a8f4a5eda8bf8f43762c9fcde66..d4b66ac50005864fb3be3f41079bd09ec637fc9f 100644 (file)
--- a/lib/gnutls_x509.c
+++ b/lib/gnutls_x509.c
@@ -1153,21 +1153,21 @@ parse_pem_ca_mem (gnutls_x509_crt_t ** cert_list, unsigned *ncerts,
       /* now we move ptr after the pem header 
        */
       ptr++;
+      size--;
       /* find the next certificate (if any)
        */
 
-      size = input_cert_size - (ptr - input_cert);
-
       if (size > 0)
        {
          char *ptr3;
 
          ptr3 = memmem (ptr, size, PEM_CERT_SEP, sizeof (PEM_CERT_SEP) - 1);
          if (ptr3 == NULL)
-           ptr = memmem (ptr, size,
+           ptr3 = memmem (ptr, size,
                          PEM_CERT_SEP2, sizeof (PEM_CERT_SEP2) - 1);
 
          ptr = ptr3;
+         size = input_cert_size - (ptr - input_cert);
        }
       else
        ptr = NULL;