diff --git a/src/crypto/x509v3/v3_utl.c b/src/crypto/x509v3/v3_utl.c index 15ebe540c..76df91ce8 100644 --- a/src/crypto/x509v3/v3_utl.c +++ b/src/crypto/x509v3/v3_utl.c @@ -1233,8 +1233,6 @@ static int ipv6_from_asc(unsigned char v6[16], const char *in) { return 0; } - // Now for some sanity checks - if (v6stat.zero_pos == -1) { // If no '::' must have exactly 16 bytes if (v6stat.total != 16) { @@ -1242,35 +1240,31 @@ static int ipv6_from_asc(unsigned char v6[16], const char *in) { } } else { // If '::' must have less than 16 bytes - if (v6stat.total == 16) { + if (v6stat.total >= 16) { return 0; } - // More than three zeroes is an error if (v6stat.zero_cnt > 3) { + // More than three zeroes is an error return 0; - } - // Can only have three zeroes if nothing else present - else if (v6stat.zero_cnt == 3) { + } else if (v6stat.zero_cnt == 3) { + // Can only have three zeroes if nothing else present if (v6stat.total > 0) { return 0; } - } - // Can only have two zeroes if at start or end - else if (v6stat.zero_cnt == 2) { - if ((v6stat.zero_pos != 0) && (v6stat.zero_pos != v6stat.total)) { + } else if (v6stat.zero_cnt == 2) { + // Can only have two zeroes if at start or end + if (v6stat.zero_pos != 0 && v6stat.zero_pos != v6stat.total) { return 0; } - } else - // Can only have one zero if *not* start or end - { - if ((v6stat.zero_pos == 0) || (v6stat.zero_pos == v6stat.total)) { + } else { + // Can only have one zero if *not* start or end + if (v6stat.zero_pos == 0 || v6stat.zero_pos == v6stat.total) { return 0; } } } - // Format result - + // Format the result. if (v6stat.zero_pos >= 0) { // Copy initial part OPENSSL_memcpy(v6, v6stat.tmp, v6stat.zero_pos); @@ -1299,9 +1293,12 @@ static int ipv6_cb(const char *elem, int len, void *usr) { // Zero length element, corresponds to '::' if (s->zero_pos == -1) { s->zero_pos = s->total; + } else if (s->zero_pos != s->total) { + // If we've already got a :: its an error + return 0; } - // If we've already got a :: its an error - else if (s->zero_pos != s->total) { + if (s->zero_cnt >= 3) { + // More than three zeros is an error. return 0; } s->zero_cnt++;