Commit 81e0cf8ea3 for openssl.org
commit 81e0cf8ea3d2c29073291ead904203634778b32a
Author: Bob Beck <beck@openssl.org>
Date: Wed Aug 5 09:39:37 2026 -0600
Don't read an ASN1_STRING data raw and assume it's 0 byte terminated
Fix latent app bug in policy error diagnostics.
Fixes: #32176
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Andrew Dinh <andrewd@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Merge-date: Thu Aug 27 13:52:39 2026
Merged-from: https://github.com/openssl/openssl/pull/32178
diff --git a/apps/ca.c b/apps/ca.c
index ff7d1cdf79..1c42a2dfe0 100644
--- a/apps/ca.c
+++ b/apps/ca.c
@@ -1628,10 +1628,18 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
if (j < 0) {
BIO_printf(bio_err,
"The %s field is different between\n"
- "CA certificate (%s) and the request (%s)\n",
- cv->name,
- ((str2 == NULL) ? "NULL" : (char *)ASN1_STRING_get0_data(str2)),
- ((str == NULL) ? "NULL" : (char *)ASN1_STRING_get0_data(str)));
+ "CA certificate (",
+ cv->name);
+ if (str2 == NULL)
+ BIO_puts(bio_err, "NULL");
+ else
+ ASN1_STRING_print_ex(bio_err, str2, ASN1_STRFLGS_RFC2253);
+ BIO_puts(bio_err, ") and the request (");
+ if (str == NULL)
+ BIO_puts(bio_err, "NULL");
+ else
+ ASN1_STRING_print_ex(bio_err, str, ASN1_STRFLGS_RFC2253);
+ BIO_puts(bio_err, ")\n");
goto end;
}
} else {