{"action":"created","comment":{"url":"https://api.github.com/repos/openssl/openssl/pulls/comments/121277514","pull_request_review_id":43316113,"id":121277514,"diff_hunk":"@@ -88,6 +104,9 @@ int asn1_generalizedtime_to_tm(struct tm *tm, const ASN1_GENERALIZEDTIME *d)\n      * digits.\n      */\n     if (a[o] == '.') {\n+        if (strict)\n+            /* RFC 5280 forbids fractional seconds */\n+            goto err;\n         if (++o > l)\n             goto err;","path":"crypto/asn1/a_gentm.c","position":46,"original_position":46,"commit_id":"acd89edaaa0b3211a6f02daed4721b865db7c320","original_commit_id":"acd89edaaa0b3211a6f02daed4721b865db7c320","user":{"login":"InfoHunter","id":799430,"avatar_url":"https://avatars0.githubusercontent.com/u/799430?v=3","gravatar_id":"","url":"https://api.github.com/users/InfoHunter","html_url":"https://github.com/InfoHunter","followers_url":"https://api.github.com/users/InfoHunter/followers","following_url":"https://api.github.com/users/InfoHunter/following{/other_user}","gists_url":"https://api.github.com/users/InfoHunter/gists{/gist_id}","starred_url":"https://api.github.com/users/InfoHunter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/InfoHunter/subscriptions","organizations_url":"https://api.github.com/users/InfoHunter/orgs","repos_url":"https://api.github.com/users/InfoHunter/repos","events_url":"https://api.github.com/users/InfoHunter/events{/privacy}","received_events_url":"https://api.github.com/users/InfoHunter/received_events","type":"User","site_admin":false},"body":"I think you're right, the check will never be true. Currently it's a 'add-then-check' mode while iterating the input time string, the check is done by comparing the value in a[o] so it works only on null-terminated strings. For this check, probably just change `++o > l` to `++o == l` is fine enough, to avoid unnecessary subsequent checks. But I would like to make this logic more clear to change it to a 'non-null-terminated-depending' style, thus we don't need to be bothered by if the `t->data` has a '\\0' or not any more. And I consider this as a more careful and more secure way of dealing with strings.\r\n\r\nThe same situations exist as well as in UTC parsing function.","created_at":"2017-06-11T10:12:47Z","updated_at":"2017-06-11T10:12:47Z","html_url":"https://github.com/openssl/openssl/pull/3566#discussion_r121277514","pull_request_url":"https://api.github.com/repos/openssl/openssl/pulls/3566","_links":{"self":{"href":"https://api.github.com/repos/openssl/openssl/pulls/comments/121277514"},"html":{"href":"https://github.com/openssl/openssl/pull/3566#discussion_r121277514"},"pull_request":{"href":"https://api.github.com/repos/openssl/openssl/pulls/3566"}}},"pull_request":{"url":"https://api.github.com/repos/openssl/openssl/pulls/3566","id":122589099,"html_url":"https://github.com/openssl/openssl/pull/3566","diff_url":"https://github.com/openssl/openssl/pull/3566.diff","patch_url":"https://github.com/openssl/openssl/pull/3566.patch","issue_url":"https://api.github.com/repos/openssl/openssl/issues/3566","number":3566,"state":"open","locked":false,"title":"RFC5280 strict time string check","user":{"login":"InfoHunter","id":799430,"avatar_url":"https://avatars0.githubusercontent.com/u/799430?v=3","gravatar_id":"","url":"https://api.github.com/users/InfoHunter","html_url":"https://github.com/InfoHunter","followers_url":"https://api.github.com/users/InfoHunter/followers","following_url":"https://api.github.com/users/InfoHunter/following{/other_user}","gists_url":"https://api.github.com/users/InfoHunter/gists{/gist_id}","starred_url":"https://api.github.com/users/InfoHunter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/InfoHunter/subscriptions","organizations_url":"https://api.github.com/users/InfoHunter/orgs","repos_url":"https://api.github.com/users/InfoHunter/repos","events_url":"https://api.github.com/users/InfoHunter/events{/privacy}","received_events_url":"https://api.github.com/users/InfoHunter/received_events","type":"User","site_admin":false},"body":"<!--\r\nThank you for your pull request. Please review these requirements:\r\n\r\nContributors guide: https://github.com/openssl/openssl/blob/master/CONTRIBUTING\r\n\r\nOther than that, provide a description above this comment if there isn't one already\r\n\r\nIf this fixes a github issue, make sure to have a line saying 'Fixes #XXXX' (without quotes) in the commit message.\r\n-->\r\n\r\n##### Checklist\r\n<!-- Remove items that do not apply. For completed items, change [ ] to [x]. -->\r\n- [x] documentation is added or updated\r\n- [x] tests are added or updated\r\n\r\nFixes #3444 \r\n\r\nThoughts: introduce a new API called \"ASN1_TIME_set_string_strict\" which is used to check if the time string (both UTC and Generalized) matches what RFC 5280 requires.\r\n\r\nTo make it compatible with those legacy certificates generated by previous versions of OpenSSL command line tool, all use the original \"loose\" rule to check the time string except the 'ca' application which is enforced to use the strict version to produce RFC-5280-fulfilled certificates only. Thus, `openssl` command can still read and use RFC-5280-time-conficting certificates but can't generate any of them.\r\n\r\nDocs and tests will be updated as this fix is generally accepted for the concept/idea.\r\n\r\nPlease ignore the first unrelated 3 outdated commits : )","created_at":"2017-05-26T07:43:51Z","updated_at":"2017-06-11T10:12:47Z","closed_at":null,"merged_at":null,"merge_commit_sha":"972acde50045c017be423fbb14f5e8cf17a522fc","assignee":null,"assignees":[],"requested_reviewers":[],"milestone":null,"commits_url":"https://api.github.com/repos/openssl/openssl/pulls/3566/commits","review_comments_url":"https://api.github.com/repos/openssl/openssl/pulls/3566/comments","review_comment_url":"https://api.github.com/repos/openssl/openssl/pulls/comments{/number}","comments_url":"https://api.github.com/repos/openssl/openssl/issues/3566/comments","statuses_url":"https://api.github.com/repos/openssl/openssl/statuses/acd89edaaa0b3211a6f02daed4721b865db7c320","head":{"label":"InfoHunter:rfc5280-time","ref":"rfc5280-time","sha":"acd89edaaa0b3211a6f02daed4721b865db7c320","user":{"login":"InfoHunter","id":799430,"avatar_url":"https://avatars0.githubusercontent.com/u/799430?v=3","gravatar_id":"","url":"https://api.github.com/users/InfoHunter","html_url":"https://github.com/InfoHunter","followers_url":"https://api.github.com/users/InfoHunter/followers","following_url":"https://api.github.com/users/InfoHunter/following{/other_user}","gists_url":"https://api.github.com/users/InfoHunter/gists{/gist_id}","starred_url":"https://api.github.com/users/InfoHunter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/InfoHunter/subscriptions","organizations_url":"https://api.github.com/users/InfoHunter/orgs","repos_url":"https://api.github.com/users/InfoHunter/repos","events_url":"https://api.github.com/users/InfoHunter/events{/privacy}","received_events_url":"https://api.github.com/users/InfoHunter/received_events","type":"User","site_admin":false},"repo":{"id":35592449,"name":"openssl","full_name":"InfoHunter/openssl","owner":{"login":"InfoHunter","id":799430,"avatar_url":"https://avatars0.githubusercontent.com/u/799430?v=3","gravatar_id":"","url":"https://api.github.com/users/InfoHunter","html_url":"https://github.com/InfoHunter","followers_url":"https://api.github.com/users/InfoHunter/followers","following_url":"https://api.github.com/users/InfoHunter/following{/other_user}","gists_url":"https://api.github.com/users/InfoHunter/gists{/gist_id}","starred_url":"https://api.github.com/users/InfoHunter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/InfoHunter/subscriptions","organizations_url":"https://api.github.com/users/InfoHunter/orgs","repos_url":"https://api.github.com/users/InfoHunter/repos","events_url":"https://api.github.com/users/InfoHunter/events{/privacy}","received_events_url":"https://api.github.com/users/InfoHunter/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/InfoHunter/openssl","description":null,"fork":true,"url":"https://api.github.com/repos/InfoHunter/openssl","forks_url":"https://api.github.com/repos/InfoHunter/openssl/forks","keys_url":"https://api.github.com/repos/InfoHunter/openssl/keys{/key_id}","collaborators_url":"https://api.github.com/repos/InfoHunter/openssl/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/InfoHunter/openssl/teams","hooks_url":"https://api.github.com/repos/InfoHunter/openssl/hooks","issue_events_url":"https://api.github.com/repos/InfoHunter/openssl/issues/events{/number}","events_url":"https://api.github.com/repos/InfoHunter/openssl/events","assignees_url":"https://api.github.com/repos/InfoHunter/openssl/assignees{/user}","branches_url":"https://api.github.com/repos/InfoHunter/openssl/branches{/branch}","tags_url":"https://api.github.com/repos/InfoHunter/openssl/tags","blobs_url":"https://api.github.com/repos/InfoHunter/openssl/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/InfoHunter/openssl/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/InfoHunter/openssl/git/refs{/sha}","trees_url":"https://api.github.com/repos/InfoHunter/openssl/git/trees{/sha}","statuses_url":"https://api.github.com/repos/InfoHunter/openssl/statuses/{sha}","languages_url":"https://api.github.com/repos/InfoHunter/openssl/languages","stargazers_url":"https://api.github.com/repos/InfoHunter/openssl/stargazers","contributors_url":"https://api.github.com/repos/InfoHunter/openssl/contributors","subscribers_url":"https://api.github.com/repos/InfoHunter/openssl/subscribers","subscription_url":"https://api.github.com/repos/InfoHunter/openssl/subscription","commits_url":"https://api.github.com/repos/InfoHunter/openssl/commits{/sha}","git_commits_url":"https://api.github.com/repos/InfoHunter/openssl/git/commits{/sha}","comments_url":"https://api.github.com/repos/InfoHunter/openssl/comments{/number}","issue_comment_url":"https://api.github.com/repos/InfoHunter/openssl/issues/comments{/number}","contents_url":"https://api.github.com/repos/InfoHunter/openssl/contents/{+path}","compare_url":"https://api.github.com/repos/InfoHunter/openssl/compare/{base}...{head}","merges_url":"https://api.github.com/repos/InfoHunter/openssl/merges","archive_url":"https://api.github.com/repos/InfoHunter/openssl/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/InfoHunter/openssl/downloads","issues_url":"https://api.github.com/repos/InfoHunter/openssl/issues{/number}","pulls_url":"https://api.github.com/repos/InfoHunter/openssl/pulls{/number}","milestones_url":"https://api.github.com/repos/InfoHunter/openssl/milestones{/number}","notifications_url":"https://api.github.com/repos/InfoHunter/openssl/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/InfoHunter/openssl/labels{/name}","releases_url":"https://api.github.com/repos/InfoHunter/openssl/releases{/id}","deployments_url":"https://api.github.com/repos/InfoHunter/openssl/deployments","created_at":"2015-05-14T05:21:58Z","updated_at":"2016-09-01T04:41:56Z","pushed_at":"2017-06-09T18:30:19Z","git_url":"git://github.com/InfoHunter/openssl.git","ssh_url":"git@github.com:InfoHunter/openssl.git","clone_url":"https://github.com/InfoHunter/openssl.git","svn_url":"https://github.com/InfoHunter/openssl","homepage":null,"size":114588,"stargazers_count":0,"watchers_count":0,"language":"C","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"openssl:master","ref":"master","sha":"9a2dfc0febaf89403cdbd4bfdb2417fd3d055e95","user":{"login":"openssl","id":3279138,"avatar_url":"https://avatars1.githubusercontent.com/u/3279138?v=3","gravatar_id":"","url":"https://api.github.com/users/openssl","html_url":"https://github.com/openssl","followers_url":"https://api.github.com/users/openssl/followers","following_url":"https://api.github.com/users/openssl/following{/other_user}","gists_url":"https://api.github.com/users/openssl/gists{/gist_id}","starred_url":"https://api.github.com/users/openssl/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openssl/subscriptions","organizations_url":"https://api.github.com/users/openssl/orgs","repos_url":"https://api.github.com/users/openssl/repos","events_url":"https://api.github.com/users/openssl/events{/privacy}","received_events_url":"https://api.github.com/users/openssl/received_events","type":"Organization","site_admin":false},"repo":{"id":7634677,"name":"openssl","full_name":"openssl/openssl","owner":{"login":"openssl","id":3279138,"avatar_url":"https://avatars1.githubusercontent.com/u/3279138?v=3","gravatar_id":"","url":"https://api.github.com/users/openssl","html_url":"https://github.com/openssl","followers_url":"https://api.github.com/users/openssl/followers","following_url":"https://api.github.com/users/openssl/following{/other_user}","gists_url":"https://api.github.com/users/openssl/gists{/gist_id}","starred_url":"https://api.github.com/users/openssl/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openssl/subscriptions","organizations_url":"https://api.github.com/users/openssl/orgs","repos_url":"https://api.github.com/users/openssl/repos","events_url":"https://api.github.com/users/openssl/events{/privacy}","received_events_url":"https://api.github.com/users/openssl/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/openssl/openssl","description":"TLS/SSL and crypto library","fork":false,"url":"https://api.github.com/repos/openssl/openssl","forks_url":"https://api.github.com/repos/openssl/openssl/forks","keys_url":"https://api.github.com/repos/openssl/openssl/keys{/key_id}","collaborators_url":"https://api.github.com/repos/openssl/openssl/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/openssl/openssl/teams","hooks_url":"https://api.github.com/repos/openssl/openssl/hooks","issue_events_url":"https://api.github.com/repos/openssl/openssl/issues/events{/number}","events_url":"https://api.github.com/repos/openssl/openssl/events","assignees_url":"https://api.github.com/repos/openssl/openssl/assignees{/user}","branches_url":"https://api.github.com/repos/openssl/openssl/branches{/branch}","tags_url":"https://api.github.com/repos/openssl/openssl/tags","blobs_url":"https://api.github.com/repos/openssl/openssl/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/openssl/openssl/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/openssl/openssl/git/refs{/sha}","trees_url":"https://api.github.com/repos/openssl/openssl/git/trees{/sha}","statuses_url":"https://api.github.com/repos/openssl/openssl/statuses/{sha}","languages_url":"https://api.github.com/repos/openssl/openssl/languages","stargazers_url":"https://api.github.com/repos/openssl/openssl/stargazers","contributors_url":"https://api.github.com/repos/openssl/openssl/contributors","subscribers_url":"https://api.github.com/repos/openssl/openssl/subscribers","subscription_url":"https://api.github.com/repos/openssl/openssl/subscription","commits_url":"https://api.github.com/repos/openssl/openssl/commits{/sha}","git_commits_url":"https://api.github.com/repos/openssl/openssl/git/commits{/sha}","comments_url":"https://api.github.com/repos/openssl/openssl/comments{/number}","issue_comment_url":"https://api.github.com/repos/openssl/openssl/issues/comments{/number}","contents_url":"https://api.github.com/repos/openssl/openssl/contents/{+path}","compare_url":"https://api.github.com/repos/openssl/openssl/compare/{base}...{head}","merges_url":"https://api.github.com/repos/openssl/openssl/merges","archive_url":"https://api.github.com/repos/openssl/openssl/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/openssl/openssl/downloads","issues_url":"https://api.github.com/repos/openssl/openssl/issues{/number}","pulls_url":"https://api.github.com/repos/openssl/openssl/pulls{/number}","milestones_url":"https://api.github.com/repos/openssl/openssl/milestones{/number}","notifications_url":"https://api.github.com/repos/openssl/openssl/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/openssl/openssl/labels{/name}","releases_url":"https://api.github.com/repos/openssl/openssl/releases{/id}","deployments_url":"https://api.github.com/repos/openssl/openssl/deployments","created_at":"2013-01-15T22:34:48Z","updated_at":"2017-06-11T09:49:07Z","pushed_at":"2017-06-10T20:05:25Z","git_url":"git://github.com/openssl/openssl.git","ssh_url":"git@github.com:openssl/openssl.git","clone_url":"https://github.com/openssl/openssl.git","svn_url":"https://github.com/openssl/openssl","homepage":"https://www.openssl.org","size":118905,"stargazers_count":4858,"watchers_count":4858,"language":"C","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":2497,"mirror_url":null,"open_issues_count":387,"forks":2497,"open_issues":387,"watchers":4858,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/openssl/openssl/pulls/3566"},"html":{"href":"https://github.com/openssl/openssl/pull/3566"},"issue":{"href":"https://api.github.com/repos/openssl/openssl/issues/3566"},"comments":{"href":"https://api.github.com/repos/openssl/openssl/issues/3566/comments"},"review_comments":{"href":"https://api.github.com/repos/openssl/openssl/pulls/3566/comments"},"review_comment":{"href":"https://api.github.com/repos/openssl/openssl/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/openssl/openssl/pulls/3566/commits"},"statuses":{"href":"https://api.github.com/repos/openssl/openssl/statuses/acd89edaaa0b3211a6f02daed4721b865db7c320"}}}}
{"actor":{"display_login":"InfoHunter"}}