[PATCH] imap-send: use ASN1_STRING_length

[Xiangfei Ding <xfding@google.com>]

From: xfding <xfding@google.com>

X.509 has never stipulated that ASN1_STRING shall be null-terminated in general.
In OpenSSL, `ASN1_STRING_get0_data()` returns an internal pointer to
the raw string payload, which is lucky for us null-terminated. This is probably
about to change as OpenSSL derivatives like BoringSSL would adopt changes so
that the data buffer would not be null-terminated anymore.

Strictly speaking, printing or accessing `ASN1_STRING` data should always query
`ASN1_STRING_length`. This means that we should adapt `host_matches` and
`verify_hostname` to use `strncasecmp` and print strings with designated length.

Signed-off-by: Xiangfei Ding <dingxiangfei2009@protonmail.ch>
Signed-off-by: Xiangfei Ding <xfding@google.com>
---
 imap-send.c | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/imap-send.c b/imap-send.c
index bf1d2cf74d..bd306b8d0a 100644
--- a/imap-send.c
+++ b/imap-send.c
@@ -225,19 +225,21 @@ static int ssl_socket_connect(struct imap_socket *sock UNUSED,
 static int host_matches(const char *host, const ASN1_STRING *asn1_str)
 {
 	const char *pattern = (const char *)ASN1_STRING_get0_data(asn1_str);
+	int pat_len = ASN1_STRING_length(asn1_str);
 
 	/* embedded NUL characters may open a security hole */
-	if (memchr(pattern, '\0', ASN1_STRING_length(asn1_str)))
-	    return 0;
+	if (memchr(pattern, '\0', pat_len))
+		return 0;
 
-	if (pattern[0] == '*' && pattern[1] == '.') {
+	if (pat_len >= 2 && pattern[0] == '*' && pattern[1] == '.') {
 		pattern += 2;
+		pat_len -= 2;
 		if (!(host = strchr(host, '.')))
 			return 0;
 		host++;
 	}
 
-	return *host && *pattern && !strcasecmp(host, pattern);
+	return *host && strlen(host) == (size_t)pat_len && !strncasecmp(host, pattern, pat_len);
 }
 
 static int verify_hostname(X509 *cert, const char *hostname)
@@ -278,8 +280,9 @@ static int verify_hostname(X509 *cert, const char *hostname)
 		return error("cannot get certificate common name");
 	if (host_matches(hostname, cname))
 		return 0;
-	return error("certificate owner '%s' does not match hostname '%s'",
-		     ASN1_STRING_get0_data(cname), hostname);
+	return error("certificate owner '%.*s' does not match hostname '%s'",
+		     (int)ASN1_STRING_length(cname),
+		     (const char *)ASN1_STRING_get0_data(cname), hostname);
 }
 
 static int ssl_socket_connect(struct imap_socket *sock,
-- 
2.56.0.385.gd3acb90ef8-goog