Allow Cast certificates to have serial numbers greater than 20 bytes.

net/cert/internal/parsed_certificate.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/internal/parsed_certificate.h"
 
 #include "net/cert/internal/name_constraints.h"
 #include "net/cert/internal/signature_algorithm.h"
 #include "net/cert/internal/verify_name_match.h"
 #include "net/der/parser.h"
 
 namespace net {
 
 namespace {
 
 WARN_UNUSED_RESULT bool GetSequenceValue(const der::Input& tlv,
                                          der::Input* value) {
   der::Parser parser(tlv);
   return parser.ReadTag(der::kSequence, value) && !parser.HasMore();
 }
 
 }  // namespace
 
 ParsedCertificate::ParsedCertificate() {}
 ParsedCertificate::~ParsedCertificate() {}
 
 scoped_refptr<ParsedCertificate> ParsedCertificate::CreateFromCertificateData(
     const uint8_t* data,
     size_t length,
-    DataSource source) {
+    DataSource source,
+    const ParseCertificateOptions& options) {
   scoped_refptr<ParsedCertificate> result(new ParsedCertificate);
 
   switch (source) {
     case DataSource::INTERNAL_COPY:
       result->cert_data_.assign(data, data + length);
       result->cert_ =
           der::Input(result->cert_data_.data(), result->cert_data_.size());
       break;
     case DataSource::EXTERNAL_REFERENCE:
       result->cert_ = der::Input(data, length);
       break;
   }
 
   if (!ParseCertificate(result->cert_, &result->tbs_certificate_tlv_,
                         &result->signature_algorithm_tlv_,
                         &result->signature_value_)) {
     return nullptr;
   }
 
-  if (!ParseTbsCertificate(result->tbs_certificate_tlv_, &result->tbs_))
+  if (!ParseTbsCertificate(result->tbs_certificate_tlv_, options,
+                           &result->tbs_)) {
     return nullptr;
+  }
 
   // Attempt to parse the signature algorithm contained in the Certificate.
   // Do not give up on failure here, since SignatureAlgorithm::CreateFromDer
   // will fail on valid but unsupported signature algorithms.
   // TODO(mattm): should distinguish between unsupported algorithms and parsing
   // errors.
   result->signature_algorithm_ =
       SignatureAlgorithm::CreateFromDer(result->signature_algorithm_tlv_);
 
   der::Input subject_value;
@@ skipping 78 matching lines @@
     // NOTE: if additional extensions are consumed here, the verification code
     // must be updated to process those extensions, since the
     // VerifyNoUnconsumedCriticalExtensions uses the unparsed_extensions_
     // variable to tell which extensions were processed.
   }
 
   return result;
 }
 
 scoped_refptr<ParsedCertificate> ParsedCertificate::CreateFromCertificateCopy(
-    const base::StringPiece& data) {
+    const base::StringPiece& data,
+    const ParseCertificateOptions& options) {
   return ParsedCertificate::CreateFromCertificateData(
       reinterpret_cast<const uint8_t*>(data.data()), data.size(),
-      DataSource::INTERNAL_COPY);
+      DataSource::INTERNAL_COPY, options);
 }
 
 bool ParsedCertificate::CreateAndAddToVector(
     const uint8_t* data,
     size_t length,
     DataSource source,
+    const ParseCertificateOptions& options,
     std::vector<scoped_refptr<ParsedCertificate>>* chain) {
   scoped_refptr<ParsedCertificate> cert(
-      CreateFromCertificateData(data, length, source));
+      CreateFromCertificateData(data, length, source, options));
   if (!cert)
     return false;
   chain->push_back(std::move(cert));
   return true;
 }
 
 }  // namespace net