Merge remote-tracking branch 'origin/maint-0.2.7'

changes/bug17404

@@ -0,0 +1,6 @@
+  o Major bugfixes (security, correctness):
+    - Fix a programming error that could cause us to read 4 bytes before
+      the beginning of an openssl string. This could be used to provoke
+      a crash on systems with an unusual malloc implementation, or
+      systems with unsual hardening installed. Fixes bug 17404; bugfix
+      on 0.2.3.6-alpha.

src/common/tortls.c

@@ -2456,6 +2456,10 @@ dn_indicates_v3_cert(X509_NAME *name)
   if (len < 0) {
     return 0;
   }
+  if (len < 4) {
+    OPENSSL_free(s);
+    return 0;
+  }
   r = fast_memneq(s + len - 4, ".net", 4);
   OPENSSL_free(s);
   return r;