OpenSSL: fix serial number tests.

net/base/x509_certificate_openssl.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/x509_certificate.h"
 
 #include <openssl/asn1.h>
 #include <openssl/crypto.h>
 #include <openssl/obj_mac.h>
 #include <openssl/pem.h>
@@ skipping 314 matching lines @@
 void X509Certificate::Initialize() {
   crypto::EnsureOpenSSLInit();
   fingerprint_ = CalculateFingerprint(cert_handle_);
   chain_fingerprint_ = CalculateChainFingerprint();
 
   ASN1_INTEGER* num = X509_get_serialNumber(cert_handle_);
   if (num) {
     serial_number_ = std::string(
         reinterpret_cast<char*>(num->data),
         num->length);
+    if ((num->type & V_ASN1_NEG) == 0 &&
+        num->length != 0 &&
+        num->data[0] >= 0x80) {

[joth, 2011/10/31 17:17:45]

nit: I find the last term slightly easier to read as
&& num->data[0] & 0x80

but I don't care that much either way.

[agl, 2011/10/31 17:23:45]

Done.

+      // The non-negative serial_number_ needs to be padded with a leading 0
+      // byte in order that the MSB isn't set.

[joth, 2011/10/31 17:17:45]

is there a reasonable hint you could add here as to why this is only needed on
openssl? maybe useful if anyone is ever diffing this with nss etc.

[agl, 2011/10/31 17:23:45]

Have expanded the comment.

+      serial_number_ = std::string("", 1) + serial_number_;
+    }
   }
 
   ParsePrincipal(cert_handle_, X509_get_subject_name(cert_handle_), &subject_);
   ParsePrincipal(cert_handle_, X509_get_issuer_name(cert_handle_), &issuer_);
   x509_util::ParseDate(X509_get_notBefore(cert_handle_), &valid_start_);
   x509_util::ParseDate(X509_get_notAfter(cert_handle_), &valid_expiry_);
 }
 
 // static
 void X509Certificate::ResetCertStore() {
@@ skipping 227 matching lines @@
   DERCache der_cache;
   if (!GetDERAndCacheIfNeeded(cert_handle, &der_cache))
     return false;
 
   return pickle->WriteData(
       reinterpret_cast<const char*>(der_cache.data),
       der_cache.data_length);
 }
 
 }  // namespace net