commit f2b4d86452c29e327a2c9cfa041b84c65e3d7a3b
author Paul Bakker <p.j.bakker@polarssl.org> Wed Nov 20 17:23:53 2013 +0100
committer Paul Bakker <p.j.bakker@polarssl.org> Thu Nov 21 17:30:23 2013 +0100
tree e8750110e9babc89edfa9f642b9d0df705c1a76f
parent c245834bc4e6749751a7c217360a332b4994f0ca

Fixed X.509 hostname comparison (with non-regular characters)

In situations with 'weird' certificate names or hostnames (containing
non-western allowed names) the check would falsely report a name or
wildcard match.

ChangeLog

diff --git a/ChangeLog b/ChangeLog
index 334d147..eca541c 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,9 @@
 PolarSSL ChangeLog (Sorted per branch, date)
 
+= PolarSSL 1.3 branch
+Bugfix
+   * Fixed X.509 hostname comparison (with non-regular characters)
+
 = PolarSSL 1.3.2 released on 2013-11-04
 Features
    * PK tests added to test framework

library/x509_crt.c

diff --git a/library/x509_crt.c b/library/x509_crt.c
index 6a127b2..6382c53 100644
--- a/library/x509_crt.c
+++ b/library/x509_crt.c
@@ -1273,11 +1273,15 @@
     {
         diff = n1[i] ^ n2[i];
 
-        if( ( n1[i] >= 'a' || n1[i] <= 'z' ) && ( diff == 0 || diff == 32 ) )
+        if( diff == 0 )
             continue;
 
-        if( ( n1[i] >= 'A' || n1[i] <= 'Z' ) && ( diff == 0 || diff == 32 ) )
+        if( diff == 32 &&
+            ( ( n1[i] >= 'a' && n1[i] <= 'z' ) ||
+              ( n1[i] >= 'A' && n1[i] <= 'Z' ) ) )
+        {
             continue;
+        }
 
         return( 1 );
     }