Allow Cast certificates to have serial numbers greater than 20 bytes, as well as non-minimal INTEGE…

net/cert/internal/parse_certificate.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/internal/parse_certificate.h"
 
 #include <utility>
 
 #include "net/der/input.h"
 #include "net/der/parse_values.h"
@@ skipping 200 matching lines @@
 //        validity             Validity,
 //        subject              Name,
 //        subjectPublicKeyInfo SubjectPublicKeyInfo,
 //        issuerUniqueID  [1]  IMPLICIT UniqueIdentifier OPTIONAL,
 //                             -- If present, version MUST be v2 or v3
 //        subjectUniqueID [2]  IMPLICIT UniqueIdentifier OPTIONAL,
 //                             -- If present, version MUST be v2 or v3
 //        extensions      [3]  EXPLICIT Extensions OPTIONAL
 //                             -- If present, version MUST be v3
 //        }
-bool ParseTbsCertificate(const der::Input& tbs_tlv, ParsedTbsCertificate* out) {
+bool ParseTbsCertificate(const der::Input& tbs_tlv,
+                         const ParseCertificateOptions& options,
+                         ParsedTbsCertificate* out) {
   der::Parser parser(tbs_tlv);
 
   //   Certificate  ::=  SEQUENCE  {
   der::Parser tbs_parser;
   if (!parser.ReadSequence(&tbs_parser))
     return false;
 
   //        version         [0]  EXPLICIT Version DEFAULT v1,
   der::Input version;
   bool has_version;
   if (!tbs_parser.ReadOptionalTag(der::ContextSpecificConstructed(0), &version,
                                   &has_version)) {
     return false;
   }
   if (has_version) {
     if (!ParseVersion(version, &out->version))
       return false;
     if (out->version == CertificateVersion::V1) {
       // The correct way to specify v1 is to omit the version field since v1 is
       // the DEFAULT.
       return false;
     }
   } else {
     out->version = CertificateVersion::V1;
   }
 
   //        serialNumber         CertificateSerialNumber,
   if (!tbs_parser.ReadTag(der::kInteger, &out->serial_number))
     return false;
-  if (!VerifySerialNumber(out->serial_number))
+  if (!options.allow_invalid_serial_numbers &&
+      !VerifySerialNumber(out->serial_number)) {
     return false;
+  }
 
   //        signature            AlgorithmIdentifier,
   if (!ReadSequenceTLV(&tbs_parser, &out->signature_algorithm_tlv))
     return false;
 
   //        issuer               Name,
   if (!ReadSequenceTLV(&tbs_parser, &out->issuer_tlv))
     return false;
 
   //        validity             Validity,
@@ skipping 308 matching lines @@
   //
   //     When the keyUsage extension appears in a certificate, at least
   //     one of the bits MUST be set to 1.
   if (BitStringIsAllZeros(*key_usage))
     return false;
 
   return true;
 }
 
 }  // namespace net