> On Mar 4, 2022, at 8:10 AM, Stefan Berger <stefanb@xxxxxxxxxxxxx> wrote:
>
>
> On 3/1/22 12:36, Eric Snowberg wrote:
>> Parse the X.509 Basic Constraints. The basic constraints extension
>> identifies whether the subject of the certificate is a CA.
>>
>> BasicConstraints ::= SEQUENCE {
>> cA BOOLEAN DEFAULT FALSE,
>> pathLenConstraint INTEGER (0..MAX) OPTIONAL }
>>
>> If the CA is true, store it in a new public_key field call key_is_ca.
>> This will be used in a follow on patch that requires knowing if the
>> public key is a CA.
>>
>> Signed-off-by: Eric Snowberg <eric.snowberg@xxxxxxxxxx>
>> ---
>> crypto/asymmetric_keys/x509_cert_parser.c | 9 +++++++++
>> include/crypto/public_key.h | 1 +
>> 2 files changed, 10 insertions(+)
>>
>> diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c
>> index 2899ed80bb18..38c907f4ce27 100644
>> --- a/crypto/asymmetric_keys/x509_cert_parser.c
>> +++ b/crypto/asymmetric_keys/x509_cert_parser.c
>> @@ -583,6 +583,15 @@ int x509_process_extension(void *context, size_t hdrlen,
>> return 0;
>> }
>> + if (ctx->last_oid == OID_basicConstraints) {
>
> Don't you have to check whether you can access v[0] and v[1]?
Good catch, I’ll add the check
> if (vlen < 3)
>
> return -EBADMSG;
I think this would be best
> or should it even be
>
> if (vlen != 3)
>
> return -EBADMSG;
since the length could be larger than 3 if the optional pathLenConstraint
is supplied.
