Fix X509CertificateTest.SerialNumbers on OpenSSL builds after http://crrev.com/107956

net/base/x509_certificate_openssl.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/x509_certificate.h"
 
 #include <openssl/asn1.h>
 #include <openssl/crypto.h>
 #include <openssl/obj_mac.h>
 #include <openssl/pem.h>
 #include <openssl/pkcs7.h>
 #include <openssl/sha.h>
 #include <openssl/ssl.h>
 #include <openssl/x509v3.h>
 
 #include "base/memory/singleton.h"
 #include "base/pickle.h"
 #include "base/sha1.h"
 #include "base/string_number_conversions.h"
+#include "base/string_util.h"
 #include "crypto/openssl_util.h"
 #include "net/base/asn1_util.h"
 #include "net/base/cert_status_flags.h"
 #include "net/base/cert_verify_result.h"
 #include "net/base/net_errors.h"
 #include "net/base/x509_util_openssl.h"
 
 namespace net {
 
 namespace {
@@ skipping 290 matching lines @@
   // free the memory and any application-specific data associated with the
   // certificate.
   X509_free(cert_handle);
 }
 
 void X509Certificate::Initialize() {
   crypto::EnsureOpenSSLInit();
   fingerprint_ = CalculateFingerprint(cert_handle_);
   chain_fingerprint_ = CalculateChainFingerprint();
 
-  ASN1_INTEGER* num = X509_get_serialNumber(cert_handle_);
-  if (num) {
-    serial_number_ = std::string(
-        reinterpret_cast<char*>(num->data),
-        num->length);
+  ASN1_INTEGER* serial_num = X509_get_serialNumber(cert_handle_);
+  if (serial_num) {
+    // ASN1_INTEGERS represent the decoded number, in a format internal to
+    // OpenSSL. Most notably, this may have leading zeroes stripped off for
+    // numbers whose first byte is >= 0x80. Thus, it is necessary to
+    // re-encoded the integer back into DER, which is what the interface
+    // of X509Certificate exposes, to ensure callers get the proper (DER)
+    // value.

[joth, 2011/11/01 09:16:33]

I think the comment already answers this, but is the re-encoded DER be
guaranteed to include that leading zero?

+    int bytes_required = i2c_ASN1_INTEGER(serial_num, NULL);
+    unsigned char* buffer = reinterpret_cast<unsigned char*>(
+        WriteInto(&serial_number_, bytes_required + 1));
+    int bytes_written = i2c_ASN1_INTEGER(serial_num, &buffer);
+    DCHECK_EQ(static_cast<size_t>(bytes_written), serial_number_.size());
   }
 
   ParsePrincipal(cert_handle_, X509_get_subject_name(cert_handle_), &subject_);
   ParsePrincipal(cert_handle_, X509_get_issuer_name(cert_handle_), &issuer_);
   x509_util::ParseDate(X509_get_notBefore(cert_handle_), &valid_start_);
   x509_util::ParseDate(X509_get_notAfter(cert_handle_), &valid_expiry_);
 }
 
 // static
 void X509Certificate::ResetCertStore() {
@@ skipping 229 matching lines @@
   DERCache der_cache;
   if (!GetDERAndCacheIfNeeded(cert_handle, &der_cache))
     return false;
 
   return pickle->WriteData(
       reinterpret_cast<const char*>(der_cache.data),
       der_cache.data_length);
 }
 
 }  // namespace net