Fix range_should_be_prefix() to actually return the correct result
authorMatt Caswell <matt@openssl.org>
Fri, 10 Jun 2022 14:58:58 +0000 (15:58 +0100)
committerRichard Levitte <levitte@openssl.org>
Tue, 5 Jul 2022 06:06:20 +0000 (08:06 +0200)
commita1d80edcf830739131e0567dc03b1e80b7988b1e
tree0f2b48b8d5f7cf81b002e6b3ac5447cbf9ae2b22
parent4c1cf6d39bb8e85658ac8c743dcff8ede730f76a
Fix range_should_be_prefix() to actually return the correct result

range_should_be_prefix() was misidentifying whether an IP address range
should in fact be represented as a prefix. This was due to a bug introduced
in commit 42d7d7dd which made this incorrect change:

-    OPENSSL_assert(memcmp(min, max, length) <= 0);
+    if (memcmp(min, max, length) <= 0)
+        return -1;

This error leads to incorrect DER being encoded/accepted.

Reported by Theo Buehler (@botovq)

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18524)

(cherry picked from commit 30532e59f475e0066c030693e4d614311a9e0cae)
(cherry picked from commit 2c6550c6db9b1b69dc24f968b4ceb534edcf4841)
crypto/x509v3/v3_addr.c
test/v3ext.c