Check self-signed certificate names and signatures

net/cert/x509_certificate_nss.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <cert.h>
 #include <cryptohi.h>
 #include <keyhi.h>
 #include <nss.h>
 #include <pk11pub.h>
 #include <prtime.h>
@@ skipping 267 matching lines @@
                                        size_t* size_bits,
                                        PublicKeyType* type) {
   x509_util::GetPublicKeyInfo(cert_handle, size_bits, type);
 }
 
 // static
 bool X509Certificate::IsSelfSigned(OSCertHandle cert_handle) {
   crypto::ScopedSECKEYPublicKey public_key(CERT_ExtractPublicKey(cert_handle));
   if (!public_key.get())
     return false;
+  SECComparison c =

[svaldez, 2016/05/20 17:54:52]

Do name check after key check to match other implementations?

[dadrian, 2016/05/20 19:01:21]

Done.

+      CERT_CompareName(&cert_handle->subject, &cert_handle->issuer);
+  if (c != SECComparison::SECEqual) {
+    return false;
+  }
   return SECSuccess == CERT_VerifySignedDataWithPublicKey(
       &cert_handle->signatureWrap, public_key.get(), NULL);
 }
 
 }  // namespace net