From: beck <beck@openbsd.org>
Date: Sun, 28 May 2023 09:06:34 +0000 (+0000)
Subject: correct comment, spotted by tb@
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=8a41a05780ca279e3767b313b18c4d9f81e0649a;p=openbsd

correct comment, spotted by tb@
---

diff --git a/lib/libtls/tls_verify.c b/lib/libtls/tls_verify.c
index 420e278c996..acc034d9c13 100644
--- a/lib/libtls/tls_verify.c
+++ b/lib/libtls/tls_verify.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls_verify.c,v 1.24 2023/05/28 09:02:01 beck Exp $ */
+/* $OpenBSD: tls_verify.c,v 1.25 2023/05/28 09:06:34 beck Exp $ */
 /*
  * Copyright (c) 2014 Jeremie Courreges-Anglas <jca@openbsd.org>
  *
@@ -243,9 +243,9 @@ tls_check_common_name(struct tls *ctx, X509 *cert, const char *name,
 	data = X509_NAME_ENTRY_get_data(X509_NAME_get_entry(subject_name,
 	    lastpos));
 	/*
-	 * Fail if we cannot encode as UTF-8, or if the UTF-8 encoding of the
-	 * string contains a 0 byte. We treat any certificate with such data
-	 * in the CN as hostile and fail.
+	 * Fail if we cannot encode as UTF-8, if the CN is of invalid length, or
+	 * if the UTF-8 encoding of the string contains a 0 byte. We treat any
+	 * certificate with such data in the CN as hostile and fail.
 	 */
 	if ((common_name_len = ASN1_STRING_to_UTF8(&utf8_bytes, data)) < 0) {
 		tls_set_errorx(ctx, "error verifying name '%s': "