Refuse to return DNs with embedded NULs which breaks other code.

Problem published by Dan Kaminsky and Moxie Marlinspike at BlackHat09.

diff --git a/lib/x509/common.c b/lib/x509/common.c
index c8ea6958be42962f0b2e5906e144c729330762f5..c44d720c4c2faf01c774bddd3c9bd7218c5ee75d 100644 (file)
--- a/lib/x509/common.c
+++ b/lib/x509/common.c
@@ -242,6 +242,10 @@ _gnutls_x509_oid_data2string (const char *oid, void *value,
     {
       str[len] = 0;
 
+      /* Refuse to deal with strings containing NULs. */
+      if (strlen (str) != len)
+       return GNUTLS_E_ASN1_DER_ERROR;
+
       if (res)
        _gnutls_str_cpy (res, *res_size, str);
       *res_size = len;
@@ -295,6 +299,10 @@ _gnutls_x509_oid_data2string (const char *oid, void *value,
        {
          str[len] = 0;
 
+         /* Refuse to deal with strings containing NULs. */
+         if (strlen (str) != len)
+           return GNUTLS_E_ASN1_DER_ERROR;
+
          if (res)
            _gnutls_str_cpy (res, *res_size, str);
          *res_size = len;