CVE-2023-0286: OpenSSL X.509 x400Address type confusion — ASN1_STRING decoded, read as ASN1_TYPE

CVE-2023-0286 is a type confusion in OpenSSL's X.509 GeneralName handling. In crypto/x509/v3_genn.c, the ASN.1 template for GENERAL_NAME uses ASN1_SEQUENCE as the decode type for the x400Address field (GEN_X400 tag=3), causing the decoder to allocate an ASN1_STRING object. However d.x400Address is declared as ASN1_TYPE* in the GENERAL_NAME union. When GENERAL_NAME_cmp() is called during CRL distribution point comparison (x509_vfy.c:1421), it calls ASN1_TYPE_cmp(a->d.x400Address, b->d.x400Address) treating the ASN1_STRING* as ASN1_TYPE*. ASN1_STRING.length (offset 0) is misread as ASN1_TYPE.type, and ASN1_STRING.data (offset 8 on 64-bit) is misread as ASN1_TYPE.value.ptr. If the x400Address content byte-length equals V_ASN1_OBJECT (6), OBJ_cmp is called with attacker-controlled bytes as ASN1_OBJECT*, causing reads at attacker-controlled addresses. Impact: memory disclosure or DoS.