From: Beat Bolli <dev+git@drbeat.li>
Date: Wed, 11 Mar 2026 21:49:23 GMT
Subject: Re: [PATCH 3/4] imap-send: remove two string length checks
Message-ID: <a64f450b-1044-421f-86ca-aa523608911b@drbeat.li>
In-Reply-To: <abFw7FMAwHPPWOBT@ugly.lan>

Hi Oswald

On 11.03.2026 14:41, Oswald Buddenhagen wrote:
> On Wed, Mar 11, 2026 at 01:11:06PM +0100, Beat Bolli wrote:
>> At this point, these two checks verify that the ASN1_STRINGs are
>> internally consistent. This may have been ok when the fields were
>> accessed directly, but now that the API is used, is unnecessary.
>>
> that argumentation makes no sense.
> the purpose of this check is to ensure that there are no embedded nulls, 
> which the matcher would be unable to deal with, which may be a security 
> hole.

Thanks for the clarification; this was the piece that I was missing.

I'll send a v2 shortly that removes this change.

Cheers, Beat