Commit 81e0cf8ea3 for openssl.org

commit 81e0cf8ea3d2c29073291ead904203634778b32a
Author: Bob Beck <beck@openssl.org>
Date:   Wed Aug 5 09:39:37 2026 -0600

    Don't read an ASN1_STRING data raw and assume it's 0 byte terminated

    Fix latent app bug in policy error diagnostics.

    Fixes: #32176
    Reviewed-by: Neil Horman <nhorman@openssl.org>
    Reviewed-by: Andrew Dinh <andrewd@openssl.org>
    Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
    Merge-date: Thu Aug 27 13:52:39 2026
    Merged-from: https://github.com/openssl/openssl/pull/32178

diff --git a/apps/ca.c b/apps/ca.c
index ff7d1cdf79..1c42a2dfe0 100644
--- a/apps/ca.c
+++ b/apps/ca.c
@@ -1628,10 +1628,18 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
                 if (j < 0) {
                     BIO_printf(bio_err,
                         "The %s field is different between\n"
-                        "CA certificate (%s) and the request (%s)\n",
-                        cv->name,
-                        ((str2 == NULL) ? "NULL" : (char *)ASN1_STRING_get0_data(str2)),
-                        ((str == NULL) ? "NULL" : (char *)ASN1_STRING_get0_data(str)));
+                        "CA certificate (",
+                        cv->name);
+                    if (str2 == NULL)
+                        BIO_puts(bio_err, "NULL");
+                    else
+                        ASN1_STRING_print_ex(bio_err, str2, ASN1_STRFLGS_RFC2253);
+                    BIO_puts(bio_err, ") and the request (");
+                    if (str == NULL)
+                        BIO_puts(bio_err, "NULL");
+                    else
+                        ASN1_STRING_print_ex(bio_err, str, ASN1_STRFLGS_RFC2253);
+                    BIO_puts(bio_err, ")\n");
                     goto end;
                 }
             } else {