Skip to content

wolfssl_local_MatchBaseName: fix 1-byte read out of bounds looking for "@" - #11237

Open
holtrop-wolfssl wants to merge 1 commit into
wolfSSL:masterfrom
holtrop-wolfssl:f-7106
Open

wolfssl_local_MatchBaseName: fix 1-byte read out of bounds looking for "@"#11237
holtrop-wolfssl wants to merge 1 commit into
wolfSSL:masterfrom
holtrop-wolfssl:f-7106

Conversation

@holtrop-wolfssl

Copy link
Copy Markdown
Contributor

Description

wolfssl_local_MatchBaseName: fix 1-byte read out of bounds looking for "@"

Fixes F-7106

Testing

How did you test?

Checklist

  • added tests
  • updated/added doxygen
  • updated appropriate READMEs
  • Updated manual and documentation

@holtrop-wolfssl holtrop-wolfssl self-assigned this Aug 21, 2026
Copilot AI lite review requested due to automatic review settings August 21, 2026 19:48

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR fixes a 1-byte out-of-bounds read in wolfssl_local_MatchBaseName() when scanning an RFC822 (email) constraint base string for '@', ensuring the length bound is checked before dereferencing the pointer. This fits into wolfCrypt’s ASN.1 / certificate name-constraints handling, improving memory safety in certificate validation paths.

Changes:

  • Reordered the loop condition in wolfssl_local_MatchBaseName() to prevent dereferencing base[baseSz] when the base contains no '@'.
  • Added a regression test that copies the base into a heap buffer of exactly baseSz bytes (no NUL terminator) to make the prior over-read detectable under ASAN/valgrind.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File Description
wolfcrypt/src/asn.c Fixes the RFC822 base scan loop to check bounds before dereference, preventing a 1-byte OOB read.
tests/api/test_asn.c Adds a regression test using a non-NUL-terminated heap buffer to detect the historical over-read with sanitizers.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants