| Index: net/cert/internal/verify_certificate_chain.cc
|
| diff --git a/net/cert/internal/verify_certificate_chain.cc b/net/cert/internal/verify_certificate_chain.cc
|
| index 506fb434befec20aca8d118e49021cf624313e87..edfbfcb570000276124f3c18e31e51cff7a5bb82 100644
|
| --- a/net/cert/internal/verify_certificate_chain.cc
|
| +++ b/net/cert/internal/verify_certificate_chain.cc
|
| @@ -26,7 +26,9 @@ using ExtensionsMap = std::map<der::Input, ParsedExtension>;
|
| // Describes all parsed properties of a certificate that are relevant for
|
| // certificate verification.
|
| struct FullyParsedCert {
|
| - ParsedCertificate cert;
|
| + der::Input tbs_certificate_tlv;
|
| + der::Input signature_algorithm_tlv;
|
| + der::BitString signature_value;
|
| ParsedTbsCertificate tbs;
|
|
|
| std::unique_ptr<SignatureAlgorithm> signature_algorithm;
|
| @@ -84,19 +86,20 @@ WARN_UNUSED_RESULT bool GetSequenceValue(const der::Input& tlv,
|
| WARN_UNUSED_RESULT bool FullyParseCertificate(const der::Input& cert_tlv,
|
| FullyParsedCert* out) {
|
| // Parse the outer Certificate.
|
| - if (!ParseCertificate(cert_tlv, &out->cert))
|
| + if (!ParseCertificate(cert_tlv, &out->tbs_certificate_tlv,
|
| + &out->signature_algorithm_tlv, &out->signature_value))
|
| return false;
|
|
|
| // Parse the signature algorithm contained in the Certificate (there is
|
| // another one in the TBSCertificate, which is checked later by
|
| // VerifySignatureAlgorithmsMatch)
|
| out->signature_algorithm =
|
| - SignatureAlgorithm::CreateFromDer(out->cert.signature_algorithm_tlv);
|
| + SignatureAlgorithm::CreateFromDer(out->signature_algorithm_tlv);
|
| if (!out->signature_algorithm)
|
| return false;
|
|
|
| // Parse the TBSCertificate.
|
| - if (!ParseTbsCertificate(out->cert.tbs_certificate_tlv, &out->tbs))
|
| + if (!ParseTbsCertificate(out->tbs_certificate_tlv, &out->tbs))
|
| return false;
|
|
|
| // Reset state relating to extensions (which may not get overwritten). This is
|
| @@ -244,7 +247,7 @@ WARN_UNUSED_RESULT bool IsRsaWithSha1SignatureAlgorithm(
|
| // compatibility sake.
|
| WARN_UNUSED_RESULT bool VerifySignatureAlgorithmsMatch(
|
| const FullyParsedCert& cert) {
|
| - const der::Input& alg1_tlv = cert.cert.signature_algorithm_tlv;
|
| + const der::Input& alg1_tlv = cert.signature_algorithm_tlv;
|
| const der::Input& alg2_tlv = cert.tbs.signature_algorithm_tlv;
|
|
|
| // Ensure that the two DER-encoded signature algorithms are byte-for-byte
|
| @@ -279,9 +282,9 @@ WARN_UNUSED_RESULT bool BasicCertificateProcessing(
|
| // Verify the digital signature using the previous certificate's key (RFC
|
| // 5280 section 6.1.3 step a.1).
|
| if (!skip_issuer_checks) {
|
| - if (!VerifySignedData(
|
| - *cert.signature_algorithm, cert.cert.tbs_certificate_tlv,
|
| - cert.cert.signature_value, working_spki, signature_policy)) {
|
| + if (!VerifySignedData(*cert.signature_algorithm, cert.tbs_certificate_tlv,
|
| + cert.signature_value, working_spki,
|
| + signature_policy)) {
|
| return false;
|
| }
|
| }
|
| @@ -515,12 +518,15 @@ std::unique_ptr<TrustAnchor> TrustAnchor::CreateFromCertificateData(
|
| }
|
|
|
| // Parse the certificate to get its name.
|
| - ParsedCertificate cert;
|
| - if (!ParseCertificate(result->cert(), &cert))
|
| + der::Input tbs_certificate_tlv;
|
| + der::Input signature_algorithm_tlv;
|
| + der::BitString signature_value;
|
| + if (!ParseCertificate(result->cert(), &tbs_certificate_tlv,
|
| + &signature_algorithm_tlv, &signature_value))
|
| return nullptr;
|
|
|
| ParsedTbsCertificate tbs;
|
| - if (!ParseTbsCertificate(cert.tbs_certificate_tlv, &tbs))
|
| + if (!ParseTbsCertificate(tbs_certificate_tlv, &tbs))
|
| return nullptr;
|
|
|
| result->name_ = tbs.subject_tlv;
|
| @@ -728,10 +734,13 @@ WARN_UNUSED_RESULT bool BuildSimplePathToTrustAnchor(
|
| // Otherwise if it is not trusted, check whether its issuer is trusted. If
|
| // so, make *that* trusted certificate the root. If the issuer is not in
|
| // the trust store then give up and fail (this is not full path building).
|
| - ParsedCertificate cert;
|
| + der::Input tbs_certificate_tlv;
|
| + der::Input signature_algorithm_tlv;
|
| + der::BitString signature_value;
|
| ParsedTbsCertificate tbs;
|
| - if (!ParseCertificate(certs_der.back(), &cert) ||
|
| - !ParseTbsCertificate(cert.tbs_certificate_tlv, &tbs)) {
|
| + if (!ParseCertificate(certs_der.back(), &tbs_certificate_tlv,
|
| + &signature_algorithm_tlv, &signature_value) ||
|
| + !ParseTbsCertificate(tbs_certificate_tlv, &tbs)) {
|
| return false;
|
| }
|
|
|
|
|