please test imminent 2.8.x release

[Simon Josefsson]

Tomas Hoger <thoger at redhat.com> writes:

> Hi Simon!
>
> Simon Josefsson <simon <at> josefsson.org> writes:
>
>> Because of the NUL in CN/SAN issue we need to release a stable 2.8.x
>> update quickly.
>> 
>> Please test the release candidate:
>> 
>> http://daily.josefsson.org/gnutls-2.8/gnutls-2.8-20090806.tar.gz
>> 
>> This will be identical with the release unless I hear anything negative.
>> 
>> You can also help by reviewing the changes since 2.8.1:
>> 
>> http://git.savannah.gnu.org/cgit/gnutls.git/log/?h=gnutls_2_8_x
>
> Is it intentional that 2.8.2 does contain 21bc1439e5, but does not
> contain 9b0dc81885 and c9dba57f8d?  Moreover, is 21bc1439e5 still
> needed with 74b6d92f96 applied?  It seems that if there is NUL,
> GNUTLS_E_ASN1_DER_ERROR is returned earlier or res is passed through
> _gnutls_x509_data2hex() and hence should not contain NULs any more.

You are right.  21bc1439e5 is no longer needed and should not have been
in 2.8.x.  I wonder why the self-tests didn't catch that, by reading the
code it would seem to trigger an out-of-bounds read in some situations.

I'm wondering whether I need to release a 2.8.3 now...  or whether the
out-of-bounds read never happens in the 2.8.x branch for some other
reason.

See fixes at:
http://git.savannah.gnu.org/cgit/gnutls.git/commit/?h=gnutls_2_8_x&id=c12e7507562d5f168330acf1dd7db7cc2079cdf0
http://git.savannah.gnu.org/cgit/gnutls.git/commit/?h=gnutls_2_8_x&id=e52cbea94e67334c2c8e64c4bbb13d84c9d4433a

Thanks,
/Simon