From a7dad26c4bf80b65c1abd51e1695b3895add27f5 Mon Sep 17 00:00:00 2001 From: Tjerk Meesters Date: Tue, 29 Jul 2014 19:15:01 +0800 Subject: [PATCH] Wildcards should only be used in the first name component; fixed comment style --- ext/openssl/xp_ssl.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/ext/openssl/xp_ssl.c b/ext/openssl/xp_ssl.c index 03a84bf363..ba35c8828a 100644 --- a/ext/openssl/xp_ssl.c +++ b/ext/openssl/xp_ssl.c @@ -274,11 +274,12 @@ static zend_bool matches_wildcard_name(const char *subjectname, const char *cert return 1; } - if (!(wildcard = strchr(certname, '*'))) { + /* wildcard, if present, must only be present in the left-most component */ + if (!(wildcard = strchr(certname, '*')) || memchr(certname, '.', wildcard - certname)) { return 0; } - // 1) prefix, if not empty, must match subject + /* 1) prefix, if not empty, must match subject */ prefix_len = wildcard - certname; if (prefix_len && strncasecmp(subjectname, certname, prefix_len) != 0) { return 0; -- 2.40.0