From 92a6e77c186754a58212cfecd5d26755119dd63d Mon Sep 17 00:00:00 2001
From: Kareem <kareem@wolfssl.com>
Date: Wed, 1 Apr 2026 11:28:45 -0700
Subject: [PATCH 1/2] Exit MatchDomainName if pattern or string length reach 0.

---
 src/internal.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/internal.c b/src/internal.c
index 516f7ccc68..fee5c0ad52 100644
--- a/src/internal.c
+++ b/src/internal.c
@@ -13276,7 +13276,7 @@ int MatchDomainName(const char* pattern, int patternLen, const char* str,
         return 1;
 #endif
 
-    while (patternLen > 0) {
+    while (patternLen > 0 && strLen > 0) {
         /* Get the next pattern char to evaluate */
         char p = (char)XTOLOWER((unsigned char)*pattern);
         if (p == '\0')

From 5d204d552d00dd5eab228f7af5db1460e18f276c Mon Sep 17 00:00:00 2001
From: Kareem <kareem@wolfssl.com>
Date: Wed, 1 Apr 2026 11:50:17 -0700
Subject: [PATCH 2/2] Rework check to avoid changing existing logic.

---
 src/internal.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/internal.c b/src/internal.c
index fee5c0ad52..0d0d78ab31 100644
--- a/src/internal.c
+++ b/src/internal.c
@@ -13276,7 +13276,7 @@ int MatchDomainName(const char* pattern, int patternLen, const char* str,
         return 1;
 #endif
 
-    while (patternLen > 0 && strLen > 0) {
+    while (patternLen > 0) {
         /* Get the next pattern char to evaluate */
         char p = (char)XTOLOWER((unsigned char)*pattern);
         if (p == '\0')
@@ -13347,6 +13347,9 @@ int MatchDomainName(const char* pattern, int patternLen, const char* str,
                 wildcardEligible = 0;
             }
 
+            if (strLen == 0)
+                return 0;
+
             /* Simple case, pattern match exactly */
             if (p != (char)XTOLOWER((unsigned char) *str))
                 return 0;