net: retain leading zero bytes in X.509 serial numbers.

net/base/crl_set.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/base64.h"
 #include "base/json/json_reader.h"
 #include "base/logging.h"
 #include "base/stl_util.h"
 #include "base/values.h"
 #include "crypto/sha2.h"
@@ skipping 390 matching lines @@
   if (i != crls_.size())
     return false;
 
   *out_crl_set = crl_set;
   return true;
 }
 
 CRLSet::Result CRLSet::CheckCertificate(
     const base::StringPiece& serial_number,
     const base::StringPiece& parent_spki) const {
+  base::StringPiece serial(serial_number);
+
+  if (!serial.empty() && serial[0] >= 0x80) {
+    // This serial number is negative but the process which generates CRL sets
+    // will reject any certificates with negative serial numbers as invalid.
+    return UNKNOWN;
+  }
+
+  // Remove any leading zero bytes.
+  while (serial.size() > 1 && serial[0] == 0x00)
+    serial.remove_prefix(1);
+
   std::map<std::string, size_t>::const_iterator i =
       crls_index_by_issuer_.find(parent_spki.as_string());
   if (i == crls_index_by_issuer_.end())
     return UNKNOWN;
   const std::vector<std::string>& serials = crls_[i->second].second;
 
   for (std::vector<std::string>::const_iterator i = serials.begin();
        i != serials.end(); ++i) {
-    if (base::StringPiece(*i) == serial_number)
+    if (base::StringPiece(*i) == serial)
       return REVOKED;
   }
 
   return GOOD;
 }
 
 base::Time CRLSet::next_update() const {
   return next_update_;
 }
 
 base::TimeDelta CRLSet::update_window() const {
   return update_window_;
 }
 
 uint32 CRLSet::sequence() const {
   return sequence_;
 }
 
 const CRLSet::CRLList& CRLSet::crls() const {
   return crls_;
 }
 
 }  // namespace net