Re: CVE Request: libesmtp does not check NULL bytes in commonName

[Brian Stafford <brian () stafford uklinux net>]

Ludwig Nussel wrote:
> Brian Stafford wrote:
>   
> > Ludwig Nussel wrote:
> >     
> > > Brian Stafford wrote:
> > >   
> > >       
> > > > I think the best approach is to apply Pawel's patch as this is the 
> > > >         
> > > I must have missed that patch. Could you re-post it?
> > >   
> > >       
> > It's available at https://bugzilla.redhat.com/attachment.cgi?id=399131
> >     
>
> Doesn't that lack a null byte check for subjAltNames?
>
> cu
> Ludwig
>
>   
You're right.  I'll look over your patch again.  One small issue I have 
is that declarations are interspersed with code which is not standard 
pre-C99, although if speed is of the essence this can be ignored as I 
will get an official libESMTP release out soon.

Regards
Brian