return cmp ? cmp : a->length - b->length;
}
+static int IPAddressFamily_check_len(const IPAddressFamily *f)
+{
+ if (f->addressFamily->length < 2 || f->addressFamily->length > 3)
+ return 0;
+ else
+ return 1;
+}
+
/*
* Check whether an IPAddrBLocks is in canonical form.
*/
const IPAddressFamily *a = sk_IPAddressFamily_value(addr, i);
const IPAddressFamily *b = sk_IPAddressFamily_value(addr, i + 1);
+ if (!IPAddressFamily_check_len(a) || !IPAddressFamily_check_len(b))
+ return 0;
+
if (IPAddressFamily_cmp(&a, &b) >= 0)
return 0;
}
return 0;
}
+ if (!IPAddressFamily_check_len(f))
+ return 0;
+
/*
* It's an IPAddressOrRanges sequence, check it.
*/
for (i = 0; i < sk_IPAddressFamily_num(addr); i++) {
IPAddressFamily *f = sk_IPAddressFamily_value(addr, i);
+ if (!IPAddressFamily_check_len(f))
+ return 0;
+
if (f->ipAddressChoice->type == IPAddressChoice_addressesOrRanges &&
!IPAddressOrRanges_canonize(f->ipAddressChoice->
u.addressesOrRanges,
int j = sk_IPAddressFamily_find(b, fa);
IPAddressFamily *fb = sk_IPAddressFamily_value(b, j);
+ if (!IPAddressFamily_check_len(fa) || !IPAddressFamily_check_len(fb))
+ return 0;
if (fb == NULL)
return 0;
if (!addr_contains(fb->ipAddressChoice->u.addressesOrRanges,
for (j = 0; j < sk_IPAddressFamily_num(child); j++) {
IPAddressFamily *fc = sk_IPAddressFamily_value(child, j);
+ if (!IPAddressFamily_check_len(fc))
+ return 0;
+
if (fc->ipAddressChoice->type != IPAddressChoice_inherit) {
validation_err(X509_V_ERR_UNNESTED_RESOURCE);
break;
IPAddressFamily *fp =
sk_IPAddressFamily_value(x->rfc3779_addr, k);
+ if (!IPAddressFamily_check_len(fc) || !IPAddressFamily_check_len(fp))
+ return 0;
+
if (fp == NULL) {
if (fc->ipAddressChoice->type ==
IPAddressChoice_addressesOrRanges) {
for (j = 0; j < sk_IPAddressFamily_num(x->rfc3779_addr); j++) {
IPAddressFamily *fp = sk_IPAddressFamily_value(x->rfc3779_addr, j);
+ if (!IPAddressFamily_check_len(fp))
+ return 0;
+
if (fp->ipAddressChoice->type == IPAddressChoice_inherit
&& sk_IPAddressFamily_find(child, fp) >= 0)
validation_err(X509_V_ERR_UNNESTED_RESOURCE);