From 900fba616fe4102575473385205ae7ec7c2eb68f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Manuel=20P=C3=A9gouri=C3=A9-Gonnard?= Date: Wed, 18 Oct 2017 14:28:11 +0200 Subject: [PATCH] Fix check_wildcard() calling convention We shouldn't return a surprising value in case there is no wildcard and then rely on the caller to ensure that this doesn't happen --- library/x509_crt.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/library/x509_crt.c b/library/x509_crt.c index 782a5cabe..e8a46da09 100644 --- a/library/x509_crt.c +++ b/library/x509_crt.c @@ -1770,8 +1770,9 @@ static int x509_check_wildcard( const char *cn, const mbedtls_x509_buf *name ) size_t i; size_t cn_idx = 0, cn_len = strlen( cn ); + /* We can't have a match if there is no wildcard to match */ if( name->len < 3 || name->p[0] != '*' || name->p[1] != '.' ) - return( 0 ); + return( -1 ); for( i = 0; i < cn_len; ++i ) { @@ -2194,9 +2195,7 @@ static int x509_crt_check_cn( const mbedtls_x509_buf *name, } /* try wildcard match */ - if( name->len > 2 && - memcmp( name->p, "*.", 2 ) == 0 && - x509_check_wildcard( cn, name ) == 0 ) + if( x509_check_wildcard( cn, name ) == 0 ) { return( 0 ); }