ossl_verifyhost assumes OpenSSL ASN1_STRING to be null terminated

[divVerent]

I did this

ossl_verifyhost assumes OpenSSL ASN1_STRING to be null terminated, but OpenSSL docs say:

In general it cannot be assumed that the data returned by ASN1_STRING_data() is null terminated or does not contain embedded nulls. The actual format of the data will depend on the actual string type itself: for example for an IA5String the data will be ASCII, for a BMPString two bytes per character in big endian format, and for a UTF8String it will be in UTF8 format.

I verified this by making a local change to BoringSSL to no longer null terminate ASN1_STRING objects, and tests found one more affected place. Note that this may not be exhaustive yet, but a larger code base works fine after fixing this one function in curl at HEAD.

Impact of the bug is:

• Error: "SSL: illegal cert name field"
• Sometimes even: "SSL: certificate subject name 'serverRANDOMUNPRINTABLESTUFF' does not match target hostname 'localhost'"

Will send a PR to fix it.

I expected the following

Host name comparison keeps working when the SSL library does not null terminate ASN1_STRING objects.

curl/libcurl version

curl 8.22.1-DEV (Linux) libcurl/8.22.1-DEV OpenSSL/3.6.3 zlib/1.3.2 brotli/1.2.0 zstd/1.5.7 libidn2/2.3.8 libpsl/0.21.2 libssh2/1.11.1 nghttp2/1.68.1 OpenLDAP/2.6.10
Release-Date: [unreleased]
Protocols: dict file ftp ftps gopher gophers http https imap imaps ipfs ipns ldap ldaps mqtt mqtts pop3 pop3s rtsp scp sftp smtp smtps telnet tftp ws wss
Features: alt-svc AsynchDNS brotli HSTS HTTP2 HTTPS-proxy IDN IPv6 Largefile libz PSL SSL threadsafe UnixSockets zstd

operating system

Linux 7.1.6-1-amd64 #1 SMP PREEMPT_DYNAMIC Debian 7.1.6-1 (2026-08-05) x86_64 GNU/Linux