commit 8c24aa4

bearssl: Add patch to disallow empty wildcards and wildcards under TLD level

 1@@ -0,0 +1,67 @@
 2+From 7077cb239f9405b02b4db968dff0d2fa16698893 Mon Sep 17 00:00:00 2001
 3+From: Michael Forney <mforney@mforney.org>
 4+Date: Sat, 13 Nov 2021 11:28:29 -0800
 5+Subject: [PATCH] Disallow empty wildcards and wildcards at TLD level
 6+
 7+---
 8+ src/x509/x509_minimal.c  | 10 +++++++++-
 9+ src/x509/x509_minimal.t0 | 10 +++++++++-
10+ 2 files changed, 18 insertions(+), 2 deletions(-)
11+
12+diff --git a/src/x509/x509_minimal.c b/src/x509/x509_minimal.c
13+index 04f149b..fc5fa6b 100644
14+--- a/src/x509/x509_minimal.c
15++++ b/src/x509/x509_minimal.c
16+@@ -1474,13 +1474,21 @@ br_x509_minimal_run(void *t0ctx)
17+ 	if (n2 >= 2 && CTX->pad[1] == '*' && CTX->pad[2] == '.') {
18+ 		size_t u;
19+ 
20++		u = 3;
21++		while (u <= n2 && CTX->pad[u] != '.') {
22++			u ++;
23++		}
24++		if (u > n2) {
25++			T0_PUSH(0);
26++			T0_RET();
27++		}
28+ 		u = 0;
29+ 		while (u < n1 && CTX->server_name[u] != '.') {
30+ 			u ++;
31+ 		}
32+ 		u ++;
33+ 		n1 -= u;
34+-		if ((n2 - 2) == n1
35++		if (u > 1 && (n2 - 2) == n1
36+ 			&& eqnocase(&CTX->pad[3], CTX->server_name + u, n1))
37+ 		{
38+ 			T0_PUSHi(-1);
39+diff --git a/src/x509/x509_minimal.t0 b/src/x509/x509_minimal.t0
40+index 80a3701..d3d01da 100644
41+--- a/src/x509/x509_minimal.t0
42++++ b/src/x509/x509_minimal.t0
43+@@ -778,13 +778,21 @@ cc: match-server-name ( -- bool ) {
44+ 	if (n2 >= 2 && CTX->pad[1] == '*' && CTX->pad[2] == '.') {
45+ 		size_t u;
46+ 
47++		u = 3;
48++		while (u <= n2 && CTX->pad[u] != '.') {
49++			u ++;
50++		}
51++		if (u > n2) {
52++			T0_PUSH(0);
53++			T0_RET();
54++		}
55+ 		u = 0;
56+ 		while (u < n1 && CTX->server_name[u] != '.') {
57+ 			u ++;
58+ 		}
59+ 		u ++;
60+ 		n1 -= u;
61+-		if ((n2 - 2) == n1
62++		if (u > 1 && (n2 - 2) == n1
63+ 			&& eqnocase(&CTX->pad[3], CTX->server_name + u, n1))
64+ 		{
65+ 			T0_PUSHi(-1);
66+-- 
67+2.49.0
68+

1@@ -1 +1 @@
2-0.6-39-g7bea48e
3+0.6-39-g7bea48e r1