From c28475413f82e1f34295d5c039f0c0a4ca2ee526 Mon Sep 17 00:00:00 2001 From: Alexander Sosedkin Date: Mon, 26 Jan 2026 20:14:33 +0100 Subject: [PATCH] x509/name_constraints: reject some malformed domain names Signed-off-by: Alexander Sosedkin Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/c28475413f82e1f34295d5c039f0c0a4ca2ee526] CVE: CVE-2025-14831 Signed-off-by: Vijay Anusuri --- lib/x509/name_constraints.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/lib/x509/name_constraints.c b/lib/x509/name_constraints.c index d07482e3c9..9783d92851 100644 --- a/lib/x509/name_constraints.c +++ b/lib/x509/name_constraints.c @@ -159,6 +159,23 @@ static int validate_name_constraints_node(gnutls_x509_subject_alt_name_t type, return gnutls_assert_val(GNUTLS_E_MALFORMED_CIDR); } + /* Validate DNS names and email addresses for malformed input */ + if (type == GNUTLS_SAN_DNSNAME || type == GNUTLS_SAN_RFC822NAME) { + unsigned int i; + if (name->size == 0) + return GNUTLS_E_SUCCESS; + + /* reject names with consecutive dots... */ + for (i = 0; i + 1 < name->size; i++) { + if (name->data[i] == '.' && name->data[i + 1] == '.') + return gnutls_assert_val( + GNUTLS_E_ILLEGAL_PARAMETER); + } + /* ... or names consisting exclusively of dots */ + if (name->size == 1 && name->data[0] == '.') + return gnutls_assert_val(GNUTLS_E_ILLEGAL_PARAMETER); + } + return GNUTLS_E_SUCCESS; } -- GitLab