From: Simon Josefsson <simon@josefsson.org>
Date: Mon, 22 Jun 2009 09:30:05 +0000 (+0200)
Subject: Fix off-by-one size computation that leads to truncated strings.
X-Git-Tag: gnutls_2_9_2~61^2~6
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=2773e82dd323c2699f6846a7691bf4fba697703f;p=thirdparty%2Fgnutls.git

Fix off-by-one size computation that leads to truncated strings.
Reported by Tim Kosse <tim.kosse@filezilla-project.org> in
<http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3651>.
---

diff --git a/lib/x509/dn.c b/lib/x509/dn.c
index 662fd9f236..daf14dfece 100644
--- a/lib/x509/dn.c
+++ b/lib/x509/dn.c
@@ -36,7 +36,7 @@
  */
 
 /* Converts the given OID to an ldap acceptable string or
- * a dotted OID. 
+ * a dotted OID.
  */
 static const char *
 oid2ldap_string (const char *oid)
@@ -240,7 +240,8 @@ _gnutls_x509_parse_dn (ASN1_TYPE asn1_struct,
 	  ldap_desc = oid2ldap_string (oid);
 	  printable = _gnutls_x509_oid_data_printable (oid);
 
-	  sizeof_escaped = 2 * len + 1;
+	  /* leading #, hex encoded value and terminating NULL */
+	  sizeof_escaped = 2 * len + 2;
 
 	  escaped = gnutls_malloc (sizeof_escaped);
 	  if (escaped == NULL)
@@ -310,7 +311,7 @@ _gnutls_x509_parse_dn (ASN1_TYPE asn1_struct,
       _gnutls_string_get_data( &out_str, buf, sizeof_buf);
       buf[*sizeof_buf] = 0;
     }
-  else 
+  else
     *sizeof_buf = out_str.length;
 
   result = 0;