From 954307bb75302d454cc5ee22d1410e82cae7ce84 Mon Sep 17 00:00:00 2001
From: Jeremy Levartovsky <140487034+JayOfTheKeyboard@users.noreply.github.com>
Date: Mon, 12 Oct 2026 21:34:38 +1100
Subject: [PATCH] Fix IPv6 SAN overflow in cert_write and cert_req

mbedtls_x509_crt_parse_cn_inet_pton() requires a 16-byte buffer and
writes 16 bytes for an IPv6 address, but both programs passed a 4-byte
one. Use a 16-byte buffer and record the length the function returns
instead of sizeof(ip), so IPv6 addresses are encoded as 16 bytes.

Signed-off-by: Jeremy Levartovsky <140487034+JayOfTheKeyboard@users.noreply.github.com>
---
 ChangeLog.d/x509-programs-ip-san.txt | 4 ++++
 programs/x509/cert_req.c             | 6 +++---
 programs/x509/cert_write.c           | 6 +++---
 3 files changed, 10 insertions(+), 6 deletions(-)
 create mode 100644 ChangeLog.d/x509-programs-ip-san.txt

diff --git a/ChangeLog.d/x509-programs-ip-san.txt b/ChangeLog.d/x509-programs-ip-san.txt
new file mode 100644
index 0000000000..a2e40ef032
--- /dev/null
+++ b/ChangeLog.d/x509-programs-ip-san.txt
@@ -0,0 +1,4 @@
+Bugfix
+   * Fix a stack buffer overflow in the cert_write and cert_req sample
+     programs when an IPv6 address is given in the san parameter. IPv6
+     addresses are now written correctly.
diff --git a/programs/x509/cert_req.c b/programs/x509/cert_req.c
index 73d712915a..7deb706653 100644
--- a/programs/x509/cert_req.c
+++ b/programs/x509/cert_req.c
@@ -66,7 +66,7 @@ int main(void)
     "                           DNS:value\n"            \
     "                           URI:value\n"            \
     "                           RFC822:value\n"         \
-    "                           IP:value (Only IPv4 is supported)\n" \
+    "                           IP:value (IPv4 or IPv6)\n" \
     "                           DN:list of comma separated key=value pairs\n" \
     "    key_usage=%%s        default: (empty)\n"       \
     "                        Comma-separated-list of values:\n"     \
@@ -153,7 +153,7 @@ int main(int argc, char *argv[])
     mbedtls_x509write_csr req;
     mbedtls_x509_san_list *cur, *prev;
 #if defined(MBEDTLS_X509_CRT_PARSE_C)
-    uint8_t ip[4] = { 0 };
+    uint8_t ip[16] = { 0 };
 #endif
     /*
      * Set to sane values
@@ -268,7 +268,7 @@ usage:
                         goto exit;
                     }
                     cur->node.san.unstructured_name.p = (unsigned char *) ip;
-                    cur->node.san.unstructured_name.len = sizeof(ip);
+                    cur->node.san.unstructured_name.len = ip_addr_len;
                 } else if (strcmp(q, "DN") == 0) {
                     cur->node.type = MBEDTLS_X509_SAN_DIRECTORY_NAME;
                     /* Work around an API mismatch between string_to_names() and
diff --git a/programs/x509/cert_write.c b/programs/x509/cert_write.c
index 947d73f54a..95dc7d902d 100644
--- a/programs/x509/cert_write.c
+++ b/programs/x509/cert_write.c
@@ -135,7 +135,7 @@ int main(void)
     "                             DNS:value\n"            \
     "                             URI:value\n"            \
     "                             RFC822:value\n"         \
-    "                             IP:value (Only IPv4 is supported)\n" \
+    "                             IP:value (IPv4 or IPv6)\n" \
     "                             DN:list of comma separated key=value pairs\n" \
     "    authority_identifier=%%s default: 1\n"             \
     "                            Possible values: 0, 1\n"   \
@@ -316,7 +316,7 @@ int main(int argc, char *argv[])
     size_t serial_len;
     mbedtls_asn1_sequence *ext_key_usage;
     mbedtls_x509_san_list *cur, *prev;
-    uint8_t ip[4] = { 0 };
+    uint8_t ip[16] = { 0 };
     /*
      * Set to sane values
      */
@@ -650,7 +650,7 @@ usage:
                         goto exit;
                     }
                     cur->node.san.unstructured_name.p = (unsigned char *) ip;
-                    cur->node.san.unstructured_name.len = sizeof(ip);
+                    cur->node.san.unstructured_name.len = ip_addr_len;
                 } else if (strcmp(q, "DN") == 0) {
                     cur->node.type = MBEDTLS_X509_SAN_DIRECTORY_NAME;
                     /* Work around an API mismatch between string_to_names() and