Allow Cast certificates to have serial numbers greater than 20 bytes, as well as non-minimal INTEGE…

net/cert/internal/parse_ocsp.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <algorithm>
 
 #include "base/sha1.h"
 #include "crypto/sha2.h"
 #include "net/cert/internal/parse_ocsp.h"
 
@@ skipping 481 matching lines @@
 
 }  // namespace
 
 bool GetOCSPCertStatus(const OCSPResponseData& response_data,
                        const der::Input& issuer_tbs_certificate_tlv,
                        const der::Input& cert_tbs_certificate_tlv,
                        OCSPCertStatus* out) {
   out->status = OCSPCertStatus::Status::GOOD;
 
   ParsedTbsCertificate tbs_cert;
-  if (!ParseTbsCertificate(cert_tbs_certificate_tlv, &tbs_cert))
+  if (!ParseTbsCertificate(cert_tbs_certificate_tlv, {}, &tbs_cert))
     return false;
   ParsedTbsCertificate issuer_tbs_cert;
-  if (!ParseTbsCertificate(issuer_tbs_certificate_tlv, &issuer_tbs_cert))
+  if (!ParseTbsCertificate(issuer_tbs_certificate_tlv, {}, &issuer_tbs_cert))
     return false;
 
   bool found = false;
   for (const auto& response : response_data.responses) {
     OCSPSingleResponse single_response;
     if (!ParseOCSPSingleResponse(response, &single_response))
       return false;
     if (CheckCertID(single_response.cert_id_tlv, tbs_cert, issuer_tbs_cert,
                     tbs_cert.serial_number)) {
       OCSPCertStatus new_status = single_response.cert_status;
       found = true;
       // In the case that we receive multiple responses, we keep only the
       // strictest status (REVOKED > UNKNOWN > GOOD).
       if (out->status == OCSPCertStatus::Status::GOOD ||
           new_status.status == OCSPCertStatus::Status::REVOKED) {
         *out = new_status;
       }
     }
   }
 
   if (!found)
     out->status = OCSPCertStatus::Status::UNKNOWN;
 
   return found;
 }
 
 }  // namespace net