commit 2cd7929250cf9e9f658d70dcd452f529ba08c942
author Damien Miller <djm@mindrot.org> Wed Jul 02 12:48:30 2014 +1000
committer Damien Miller <djm@mindrot.org> Wed Jul 02 12:48:30 2014 +1000
tree 5e3e72d4ec41cb05af0d8d39799e6c0c8ccb3a78
parent 99db840ee8dbbd2b3fbc6c45d0ee2f6a65e96898

   - djm@cvs.openbsd.org 2014/06/24 00:52:02
     [krl.c]
     fix bug in KRL generation: multiple consecutive revoked certificate
     serial number ranges could be serialised to an invalid format.

     Readers of a broken KRL caused by this bug will fail closed, so no
     should-have-been-revoked key will be accepted.

krl.c

diff --git a/krl.c b/krl.c
index c7aa57e..557a48e 100644
--- a/krl.c
+++ b/krl.c
@@ -14,7 +14,7 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $OpenBSD: krl.c,v 1.15 2014/04/28 03:09:18 djm Exp $ */
+/* $OpenBSD: krl.c,v 1.16 2014/06/24 00:52:02 djm Exp $ */
 
 #include "includes.h"
 
@@ -575,6 +575,7 @@
 			buffer_put_char(buf, state);
 			buffer_put_string(buf,
 			    buffer_ptr(&sect), buffer_len(&sect));
+			buffer_clear(&sect);
 		}
 
 		/* If we are starting a new section then prepare it now */