Commit ef9a766551 for openssl.org

commit ef9a76655168506596240a5a747f65ac08b9df53
Author: Bob Beck <beck@openssl.org>
Date:   Tue Aug 4 09:03:33 2026 -0600

    Don't treat a CRL distribution point URI as a NUL terminated string

    get_dp_url() returned the internal ASN1_STRING data of a DIST_POINT URI
    directly. That data has an explicit length and is not necessarily NUL
    terminated, yet load_crl() and the HTTP client it hands the URI to consume
    it as a C string, reading past the buffer for a certificate carrying a
    primitive-form IA5String URI in its CRL distribution points.

    Return an allocated NUL terminated copy of the URI and free it in
    load_crl_crldp().

    Reviewed-by: Neil Horman <nhorman@openssl.org>
    Reviewed-by: Andrew Dinh <andrewd@openssl.org>
    Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
    Merge-date: Thu Aug 27 13:52:39 2026
    Merged-from: https://github.com/openssl/openssl/pull/32178

diff --git a/apps/lib/apps.c b/apps/lib/apps.c
index 86c69cb337..f4584975c8 100644
--- a/apps/lib/apps.c
+++ b/apps/lib/apps.c
@@ -2813,7 +2813,7 @@ int do_X509_REQ_verify(X509_REQ *x, EVP_PKEY *pkey,

 /* Get first http URL from a DIST_POINT structure */

-static const char *get_dp_url(DIST_POINT *dp)
+static char *get_dp_url(DIST_POINT *dp)
 {
     GENERAL_NAMES *gens;
     GENERAL_NAME *gen;
@@ -2828,9 +2828,11 @@ static const char *get_dp_url(DIST_POINT *dp)
         uri = GENERAL_NAME_get0_value(gen, &gtype);
         if (gtype == GEN_URI && ASN1_STRING_get_length(uri) > 6) {
             const char *uptr = (const char *)ASN1_STRING_get0_data(uri);
+            char *ret = OPENSSL_strndup(uptr, ASN1_STRING_get_length(uri));

-            if (IS_HTTP(uptr)) /* can/should not use HTTPS here */
-                return uptr;
+            if (ret != NULL && IS_HTTP(ret))
+                return ret;
+            OPENSSL_free(ret);
         }
     }
     return NULL;
@@ -2844,14 +2846,18 @@ static const char *get_dp_url(DIST_POINT *dp)
 static X509_CRL *load_crl_crldp(STACK_OF(DIST_POINT) *crldp)
 {
     int i;
-    const char *urlptr = NULL;
+    char *urlptr = NULL;

     for (i = 0; i < sk_DIST_POINT_num(crldp); i++) {
         DIST_POINT *dp = sk_DIST_POINT_value(crldp, i);

         urlptr = get_dp_url(dp);
-        if (urlptr != NULL)
-            return load_crl(urlptr, FORMAT_UNDEF, 0, "CRL via CDP");
+        if (urlptr != NULL) {
+            X509_CRL *crl = load_crl(urlptr, FORMAT_UNDEF, 0, "CRL via CDP");
+
+            OPENSSL_free(urlptr);
+            return crl;
+        }
     }
     return NULL;
 }