rpki-client: fix valid_uri() to work with non-strings

valid_uri() takes a length parameter and should honor that. Most uris
passed are NUL terminated, but the ones coming from an ASN1_STRING are
not guaranteed to be. Calling strstr() on a non-terminated string with
no match is a buffer overread. So use memmem() instead.

This is needed for rpki-client to work with OpenSSL 4.1, who, in their
infinite disregard for downstreams chose to stop NUL-terminating ASN.1
strings. A massive breaking change in a minor release that will surely
cause lots of buffer overreads. It's also not mentioned in CHANGES.md,
only in their terrible migration guide. Of course it's been documented
since forever, but who reads OpenSSL's crappy documentation anyway?

ok claudio

Author: botovq

usr.sbin/rpki-client/validate.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: validate.c,v 1.85 2026/09/10 13:11:34 tb Exp $ */
+/*	$OpenBSD: validate.c,v 1.86 2026/09/12 07:03:00 tb Exp $ */
 /*
  * Copyright (c) 2019 Kristaps Dzonsons <kristaps@bsd.lv>
  *
@@ -292,7 +292,7 @@ valid_uri(const char *uri, size_t usz, const char *proto)
 	}
 
 	/* do not allow files or directories to start with a '.' */
-	if (strstr(uri, "/.") != NULL)
+	if (memmem(uri, usz, "/.", strlen("/.")) != NULL)
 		return 0;
 
 	if (strncasecmp(uri, RSYNC_PROTO, RSYNC_PROTO_LEN) == 0) {