From 8fb2c9922a9c598fb34369a1f9f3cacb3a394eec Mon Sep 17 00:00:00 2001 From: "Dr. Stephen Henson" Date: Tue, 6 Jan 2015 15:29:28 -0500 Subject: [PATCH] RT3662: Allow leading . in nameConstraints Change by SteveH from original by John Denker (in the RT) Reviewed-by: Rich Salz (cherry picked from commit 77ff1f3b8bfaa348956c5096a2b829f2e767b4f1) --- crypto/x509v3/v3_ncons.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crypto/x509v3/v3_ncons.c b/crypto/x509v3/v3_ncons.c index a01dc64dd2..3b0f1bd1bd 100644 --- a/crypto/x509v3/v3_ncons.c +++ b/crypto/x509v3/v3_ncons.c @@ -401,7 +401,7 @@ static int nc_dns(ASN1_IA5STRING *dns, ASN1_IA5STRING *base) if (dns->length > base->length) { dnsptr += dns->length - base->length; - if (dnsptr[-1] != '.') + if (*baseptr != '.' && dnsptr[-1] != '.') return X509_V_ERR_PERMITTED_VIOLATION; }