Check TBSCertificate.algorithm and Certificate.signatureAlgorithm for

net/cert/asn1_util.h

Index: net/cert/asn1_util.h
diff --git a/net/cert/asn1_util.h b/net/cert/asn1_util.h
index fb64bfbb58b38462872e5f7e911dc8b38d86bd07..0699b75fe5b841389687aeae213b3243b97e194c 100644
--- a/net/cert/asn1_util.h
+++ b/net/cert/asn1_util.h
@@ -50,6 +50,18 @@ NET_EXPORT_PRIVATE bool ExtractCRLURLsFromDERCert(
 // present or if there was a parsing failure.
 NET_EXPORT_PRIVATE bool HasTLSFeatureExtension(base::StringPiece cert);
 
+// Extracts the two (SEQUENCE) tag-length-values for the signature
+// AlgorithmIdentifiers in a DER encoded certificate. Does not use
+// strict parsing or validate the resulting AlgorithmIdentifiers.
+//
+// Returns true on success and fills |cert_signature_algorithm_sequence|
+// with Certificate.signatureAlgorithm and |tbs_signature_algorithm_sequence|
+// with TBSCertificate.algorithm.

[Ryan Sleevi, 2017/03/09 00:45:26]

Note lines 32, 25, and 19 all make explicit statements about the lifetime of the
returned StringPiece's, but this does not. Probably worth rewording the comment:

On successful return, |cert_signature_algorithm_sequence| points into the
Certificate.signatureAlgorithm in |cert|, ...


(or however you want to word it)

[eroman, 2017/03/09 01:09:43]

Done.

+NET_EXPORT_PRIVATE bool ExtractSignatureAlgorithmsFromDERCert(
+    base::StringPiece cert,
+    base::StringPiece* cert_signature_algorithm_sequence,
+    base::StringPiece* tbs_signature_algorithm_sequence);
+
 } // namespace asn1
 
 } // namespace net