Fix a benign off-by-one error of kNumSerials in IsBlacklisted.

net/base/x509_certificate.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/x509_certificate.h"
 
 #include <stdlib.h>
 
 #include <algorithm>
 #include <map>
@@ skipping 623 matching lines @@
     cache->Remove(cert_handle_);
     FreeOSCertHandle(cert_handle_);
   }
   for (size_t i = 0; i < intermediate_ca_certs_.size(); ++i) {
     cache->Remove(intermediate_ca_certs_[i]);
     FreeOSCertHandle(intermediate_ca_certs_[i]);
   }
 }
 
 bool X509Certificate::IsBlacklisted() const {
-  static const unsigned kNumSerials = 257;
+  static const unsigned kNumSerials = 256;

[wtc, 2011/09/01 21:15:19]

I verified that 256 is correct because 255 results in a
compilation error (too many initializers).

I believe this off-by-one error is benign because the
last entry should be initialized to all zeros by the compiler.  That is an
unlikely serial number.

The only problem with the off-by-one error is the
histogram entry for the special-case certificate
will be off by one.

   static const unsigned kSerialBytes = 16;
   static const uint8 kSerials[kNumSerials][kSerialBytes] = {
     // Not a real certificate. For testing only.
     {0x07,0x7a,0x59,0xbc,0xd5,0x34,0x59,0x60,0x1c,0xa6,0x90,0x72,0x67,0xa6,0xdd,0x1c},
 
     // The next nine certificates all expire on Fri Mar 14 23:59:59 2014.
     // Some serial numbers actually have a leading 0x00 byte required to
     // encode a positive integer in DER if the most significant bit is 0.
     // We omit the leading 0x00 bytes to make all serial numbers 16 bytes.
 
@@ skipping 285 matching lines @@
   }
 
   // Special case for DigiNotar: this serial number had a leading 0x00 byte
   static const uint8 kDigiNotarLeadingZero[15] = {
     0x17,0x7f,0xb6,0x53,0x6b,0x98,0xce,0x40,0xd5,0x4b,0x8b,0x24,0xe3,0x16,0x05
   };
 
   if (serial_number_.size() == sizeof(kDigiNotarLeadingZero) &&
       memcmp(serial_number_.data(), kDigiNotarLeadingZero,
              sizeof(kDigiNotarLeadingZero)) == 0) {
-        UMA_HISTOGRAM_ENUMERATION("Net.SSLCertBlacklisted", kNumSerials, kNumSerials + 1);
-        return true;
+    UMA_HISTOGRAM_ENUMERATION("Net.SSLCertBlacklisted", kNumSerials,
+                              kNumSerials + 1);
+    return true;
   }
 
   return false;
 }
 
 // static
 bool X509Certificate::IsPublicKeyBlacklisted(
     const std::vector<SHA1Fingerprint>& public_key_hashes) {
   static const unsigned kNumHashes = 3;
   static const uint8 kHashes[kNumHashes][base::SHA1_LENGTH] = {
@@ skipping 26 matching lines @@
 bool X509Certificate::IsSHA1HashInSortedArray(const SHA1Fingerprint& hash,
                                               const uint8* array,
                                               size_t array_byte_len) {
   DCHECK_EQ(0u, array_byte_len % base::SHA1_LENGTH);
   const unsigned arraylen = array_byte_len / base::SHA1_LENGTH;
   return NULL != bsearch(hash.data, array, arraylen, base::SHA1_LENGTH,
                          CompareSHA1Hashes);
 }
 
 }  // namespace net