Check self-signed certificate names and signatures

net/cert/x509_certificate_win.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/x509_certificate.h"
 
 #include <memory>
 
 #include <openssl/sha.h>
 
@@ skipping 446 matching lines @@
                                    valid_issuers)) {
       return true;
     }
   }
 
   return false;
 }
 
 // static
 bool X509Certificate::IsSelfSigned(OSCertHandle cert_handle) {
-  return !!CryptVerifyCertificateSignatureEx(
-      NULL,
-      X509_ASN_ENCODING,
-      CRYPT_VERIFY_CERT_SIGN_SUBJECT_CERT,
+  bool valid_signature = !!CryptVerifyCertificateSignatureEx(
+      NULL, X509_ASN_ENCODING, CRYPT_VERIFY_CERT_SIGN_SUBJECT_CERT,
       reinterpret_cast<void*>(const_cast<PCERT_CONTEXT>(cert_handle)),
       CRYPT_VERIFY_CERT_SIGN_ISSUER_CERT,
-      reinterpret_cast<void*>(const_cast<PCERT_CONTEXT>(cert_handle)),
-      0,
-      NULL);
+      reinterpret_cast<void*>(const_cast<PCERT_CONTEXT>(cert_handle)), 0, NULL);
+  if (!valid_signature) {
+    return false;
+  }
+  DWORD subject_size =

[svaldez, 2016/05/20 17:54:52]

Don't know whether its worth it, though it might be cleaner to use
CertPrincipal.ParseDistinguishedName from x509_cert_types.

[dadrian, 2016/05/20 19:01:21]

The CertPrincipal::Matches() function is explicitly listed as deprecated, and to
be removed.

+      CertNameToStr(X509_ASN_ENCODING, &cert_handle->pCertInfo->Subject,
+                    CERT_X500_NAME_STR, NULL, 0);
+  DWORD issuer_size =
+      CertNameToStr(X509_ASN_ENCODING, &cert_handle->pCertInfo->Issuer,
+                    CERT_X500_NAME_STR, NULL, 0);
+  if (subject_size < 1 || issuer_size < 1) {
+    return false;
+  }
+  std::unique_ptr<WCHAR[]> subject(new WCHAR[subject_size]);
+  std::unique_ptr<WCHAR[]> issuer(new WCHAR[issuer_size]);
+  DWORD subject_written =
+      CertNameToStr(X509_ASN_ENCODING, &cert_handle->pCertInfo->Subject,
+                    CERT_X500_NAME_STR, subject.get(), subject_size);
+  DWORD issuer_written =
+      CertNameToStr(X509_ASN_ENCODING, &cert_handle->pCertInfo->Issuer,
+                    CERT_X500_NAME_STR, issuer.get(), issuer_size);
+  if (subject_written != issuer_written) {
+    return false;
+  }
+  return memcmp(subject.get(), issuer.get(), subject_written * sizeof(WCHAR)) ==
+         0;
 }
 
 }  // namespace net