From 8a41a05780ca279e3767b313b18c4d9f81e0649a Mon Sep 17 00:00:00 2001 From: beck Date: Sun, 28 May 2023 09:06:34 +0000 Subject: [PATCH] correct comment, spotted by tb@ --- lib/libtls/tls_verify.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/lib/libtls/tls_verify.c b/lib/libtls/tls_verify.c index 420e278c996..acc034d9c13 100644 --- a/lib/libtls/tls_verify.c +++ b/lib/libtls/tls_verify.c @@ -1,4 +1,4 @@ -/* $OpenBSD: tls_verify.c,v 1.24 2023/05/28 09:02:01 beck Exp $ */ +/* $OpenBSD: tls_verify.c,v 1.25 2023/05/28 09:06:34 beck Exp $ */ /* * Copyright (c) 2014 Jeremie Courreges-Anglas * @@ -243,9 +243,9 @@ tls_check_common_name(struct tls *ctx, X509 *cert, const char *name, data = X509_NAME_ENTRY_get_data(X509_NAME_get_entry(subject_name, lastpos)); /* - * Fail if we cannot encode as UTF-8, or if the UTF-8 encoding of the - * string contains a 0 byte. We treat any certificate with such data - * in the CN as hostile and fail. + * Fail if we cannot encode as UTF-8, if the CN is of invalid length, or + * if the UTF-8 encoding of the string contains a 0 byte. We treat any + * certificate with such data in the CN as hostile and fail. */ if ((common_name_len = ASN1_STRING_to_UTF8(&utf8_bytes, data)) < 0) { tls_set_errorx(ctx, "error verifying name '%s': " -- 2.20.1