author | Rich Burridge <rich.burridge@oracle.com> |
Fri, 23 Jan 2015 08:59:19 -0800 | |
changeset 3680 | 4dc408325e7e |
permissions | -rw-r--r-- |
3680
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
1 |
# Copied over from the desktop consolidation, which has the comment: |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
2 |
# date:2011-02-16 owner:liyuan type bug bugster:7008664 |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
3 |
# Bugster CR #7008664 is now BugDB CR #15688660 |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
4 |
# 15688660 SUNBT7008664-SOLARIS_11 CVE-2010-2074 w3m problems handling x.509 data |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
5 |
# |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
6 |
# This patch needs to be evaluated to see if it needs to be passed upstream. |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
7 |
|
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
8 |
--- w3m-0.5.2/istream.c 2007-05-23 23:06:05.000000000 +0800 |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
9 |
+++ w3m-0.5.3/istream.c 2011-01-04 17:22:22.000000000 +0800 |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
10 |
@@ -1,4 +1,4 @@ |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
11 |
-/* $Id: istream.c,v 1.26 2007/05/23 15:06:05 inu Exp $ */ |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
12 |
+/* $Id: istream.c,v 1.27 2010/07/18 13:43:23 htrb Exp $ */ |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
13 |
#include "fm.h" |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
14 |
#include "myctype.h" |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
15 |
#include "istream.h" |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
16 |
@@ -447,8 +447,17 @@ |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
17 |
|
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
18 |
if (!seen_dnsname) |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
19 |
seen_dnsname = Strnew(); |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
20 |
+ /* replace \0 to make full string visible to user */ |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
21 |
+ if (sl != strlen(sn)) { |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
22 |
+ int i; |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
23 |
+ for (i = 0; i < sl; ++i) { |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
24 |
+ if (!sn[i]) |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
25 |
+ sn[i] = '!'; |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
26 |
+ } |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
27 |
+ } |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
28 |
Strcat_m_charp(seen_dnsname, sn, " ", NULL); |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
29 |
- if (ssl_match_cert_ident(sn, sl, hostname)) |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
30 |
+ if (sl == strlen(sn) /* catch \0 in SAN */ |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
31 |
+ && ssl_match_cert_ident(sn, sl, hostname)) |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
32 |
break; |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
33 |
} |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
34 |
} |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
35 |
@@ -466,16 +475,27 @@ |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
36 |
if (match_ident == FALSE && ret == NULL) { |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
37 |
X509_NAME *xn; |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
38 |
char buf[2048]; |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
39 |
+ int slen; |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
40 |
|
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
41 |
xn = X509_get_subject_name(x); |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
42 |
|
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
43 |
- if (X509_NAME_get_text_by_NID(xn, NID_commonName, |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
44 |
- buf, sizeof(buf)) == -1) |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
45 |
+ slen = X509_NAME_get_text_by_NID(xn, NID_commonName, buf, sizeof(buf)); |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
46 |
+ if ( slen == -1) |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
47 |
/* FIXME: gettextize? */ |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
48 |
ret = Strnew_charp("Unable to get common name from peer cert"); |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
49 |
- else if (!ssl_match_cert_ident(buf, strlen(buf), hostname)) |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
50 |
+ else if (slen != strlen(buf) |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
51 |
+ || !ssl_match_cert_ident(buf, strlen(buf), hostname)) { |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
52 |
+ /* replace \0 to make full string visible to user */ |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
53 |
+ if (slen != strlen(buf)) { |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
54 |
+ int i; |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
55 |
+ for (i = 0; i < slen; ++i) { |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
56 |
+ if (!buf[i]) |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
57 |
+ buf[i] = '!'; |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
58 |
+ } |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
59 |
+ } |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
60 |
/* FIXME: gettextize? */ |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
61 |
ret = Sprintf("Bad cert ident %s from %s", buf, hostname); |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
62 |
+ } |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
63 |
else |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
64 |
match_ident = TRUE; |
4dc408325e7e
20146056 Move w3m from the Desktop consolidation to Userland
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
65 |
} |