Fail DN parsing if OID is unterminated

This is the case if the last OID is not followed by a = or if the string
starts with a =.

diff --git a/src/libstrongswan/utils/identification.c b/src/libstrongswan/utils/identification.c
index f94a1c8..06ec533 100644 (file)
--- a/src/libstrongswan/utils/identification.c
+++ b/src/libstrongswan/utils/identification.c
@@ -398,7 +398,7 @@ static status_t atodn(char *src, chunk_t *dn)
                switch (state)
                {
                        case SEARCH_OID:
-                               if (*src != ' ' && *src != '/' && *src !=  ',')
+                               if (*src != ' ' && *src != '/' && *src !=  ',' && *src != '\0')
                                {
                                        oid.ptr = src;
                                        oid.len = 1;
@@ -502,6 +502,11 @@ static status_t atodn(char *src, chunk_t *dn)
                }
        } while (*src++ != '\0');
 
+       if (state == READ_OID)
+       {       /* unterminated OID */
+               status = INVALID_ARG;
+       }
+
        /* build the distinguished name sequence */
        {
                int i;
@@ -514,7 +519,6 @@ static status_t atodn(char *src, chunk_t *dn)
                        free(rdns[i].ptr);
                }
        }
-
        if (status != SUCCESS)
        {
                free(dn->ptr);