[PATCH 2/3] hs20-osu-client: Check length of language code

[Cedric Izoard]

> > Compute the actual language code length and don't assume it is 3
> > characters long
> 
> Would you happen to have an example where this is needed and the current
> implementation not handling a two character language code?
> 
> > diff --git a/hs20/client/osu_client.c b/hs20/client/osu_client.c @@
> > -2794,18 +2794,20 @@ static int osu_cert_cb(void *_ctx, struct
> > http_cert *cert)
> > +		int lang_len = os_strlen(ctx->friendly_name[j].lang);
> > +
> >  		for (i = 0; i < cert->num_othername; i++) {
> >  			if (os_strcmp(cert->othername[i].oid,
> >  				      "1.3.6.1.4.1.40808.1.1.1") != 0)
> >  				continue;
> > -			if (cert->othername[i].len < 3)
> > +			if (cert->othername[i].len < lang_len)
> >  				continue;
> 
> This does not look correct. id-wfa-hotspot-friendlyName is defined in a way
> that it shall start with a three octet field containing the country code. If
> this is a two octet country code, there would still need to be three octets
> with the last one being 0x00.

You're right you can forget this patch
I tested using a certificate that wasn't correct and didn't take time to check the spec in details.

Sorry for the noise.

cedric