Commit c9f0103487 for openssl.org

commit c9f0103487d39358a6aae76df7a1f4a38212b8ba
Author: Bob Beck <beck@openssl.org>
Date:   Wed Aug 5 11:21:19 2026 -0600

    Fix one byte overrun in UNIVERSALSTRING_to_string

    This function assumed there was one byte more than the
    length of the string to add NUL byte termination. Don't
    do that.

    Reviewed-by: Neil Horman <nhorman@openssl.org>
    Reviewed-by: Andrew Dinh <andrewd@openssl.org>
    Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
    Merge-date: Thu Aug 27 13:52:43 2026
    Merged-from: https://github.com/openssl/openssl/pull/32178

diff --git a/crypto/asn1/a_print.c b/crypto/asn1/a_print.c
index 774d6b1383..2225d8112e 100644
--- a/crypto/asn1/a_print.c
+++ b/crypto/asn1/a_print.c
@@ -47,7 +47,7 @@ int ASN1_UNIVERSALSTRING_to_string(ASN1_UNIVERSALSTRING *s)

     if (s->type != V_ASN1_UNIVERSALSTRING)
         return 0;
-    if ((s->length % 4) != 0)
+    if (s->length < 0 || (s->length % 4) != 0)
         return 0;
     p = s->data;
     for (i = 0; i < s->length; i += 4) {
@@ -62,7 +62,8 @@ int ASN1_UNIVERSALSTRING_to_string(ASN1_UNIVERSALSTRING *s)
     for (i = 3; i < s->length; i += 4) {
         *(p++) = s->data[i];
     }
-    *(p) = '\0';
+    if (s->length > 0)
+        *p = '\0';
     s->length /= 4;
     s->type = ASN1_PRINTABLE_type(s->data, s->length);
     return 1;