Re: CVE Request: libesmtp does not check NULL bytes in commonName

[Peter Sylvester <Peter.Sylvester () edelweb fr>]

> Doesn't that lack a null byte check for subjAltNames?

The patch seems broken to me:
X509_NAME_get_text_by_NID gets the "highest" one, not the leaf value.
In case of two common names, this is wrong.

So instead of
int l = X509_NAME_get_text_by_NID (X509_get_subject_name (cert),
                            NID_commonName, buf, sizeof buf);

one needs something like:

   X509_NAME *name = X509_get_subject_name(cert) ;
    if(name)
      while((j=X509_NAME_get_index_by_NID(name,NID_commonName,i))>=0)
        i=j;