From 1274c7b5e7e9e28d88caf60662f6f9624bf834b7 Mon Sep 17 00:00:00 2001
From: Kareem <kareem@wolfssl.com>
Date: Wed, 1 Apr 2026 11:28:45 -0700
Subject: [PATCH 1/2] Exit MatchDomainName if pattern or string length reach 0.

---
 src/internal.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/internal.c b/src/internal.c
index ccc010acf7..cf06af98c3 100644
--- a/src/internal.c
+++ b/src/internal.c
@@ -13285,7 +13285,7 @@ int MatchDomainName(const char* pattern, int patternLen, const char* str,
         return 1;
 #endif
 
-    while (patternLen > 0) {
+    while (patternLen > 0 && strLen > 0) {
         /* Get the next pattern char to evaluate */
         char p = (char)XTOLOWER((unsigned char)*pattern);
         if (p == '\0')

From 90d631232308a59a03f6f6f455f9ac373db7af3d Mon Sep 17 00:00:00 2001
From: Kareem <kareem@wolfssl.com>
Date: Wed, 1 Apr 2026 11:50:17 -0700
Subject: [PATCH 2/2] Rework check to avoid changing existing logic.

---
 src/internal.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/internal.c b/src/internal.c
index cf06af98c3..ec87fd9f53 100644
--- a/src/internal.c
+++ b/src/internal.c
@@ -13285,7 +13285,7 @@ int MatchDomainName(const char* pattern, int patternLen, const char* str,
         return 1;
 #endif
 
-    while (patternLen > 0 && strLen > 0) {
+    while (patternLen > 0) {
         /* Get the next pattern char to evaluate */
         char p = (char)XTOLOWER((unsigned char)*pattern);
         if (p == '\0')
@@ -13356,6 +13356,9 @@ int MatchDomainName(const char* pattern, int patternLen, const char* str,
                 wildcardEligible = 0;
             }
 
+            if (strLen == 0)
+                return 0;
+
             /* Simple case, pattern match exactly */
             if (p != (char)XTOLOWER((unsigned char) *str))
                 return 0;