From 2cd7929250cf9e9f658d70dcd452f529ba08c942 Mon Sep 17 00:00:00 2001 From: Damien Miller Date: Wed, 2 Jul 2014 12:48:30 +1000 Subject: - djm@cvs.openbsd.org 2014/06/24 00:52:02 [krl.c] fix bug in KRL generation: multiple consecutive revoked certificate serial number ranges could be serialised to an invalid format. Readers of a broken KRL caused by this bug will fail closed, so no should-have-been-revoked key will be accepted. --- krl.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'krl.c') diff --git a/krl.c b/krl.c index c7aa57e66..557a48ebb 100644 --- a/krl.c +++ b/krl.c @@ -14,7 +14,7 @@ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $OpenBSD: krl.c,v 1.15 2014/04/28 03:09:18 djm Exp $ */ +/* $OpenBSD: krl.c,v 1.16 2014/06/24 00:52:02 djm Exp $ */ #include "includes.h" @@ -575,6 +575,7 @@ revoked_certs_generate(struct revoked_certs *rc, Buffer *buf) buffer_put_char(buf, state); buffer_put_string(buf, buffer_ptr(§), buffer_len(§)); + buffer_clear(§); } /* If we are starting a new section then prepare it now */ -- cgit v1.2.3