Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2025-01-09 13:25:00 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 969188 - Part 2/3 - mozilla::pkix only decode v3 extensions in v3 certificates. r=briansmith

Browse Source 
--HG--
extra : rebase_source : 86e58ccf8538d0f40d3b24b89a92dceac095cb21
This commit is contained in:
Camilo Viecco 2014-03-06 10:04:04 -08:00
parent a97f568c99
commit 0b1f14ef5a
1 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
security/pkix/lib/pkixbuild.cpp
View File

@ -37,6 +37,16 @@ BackCert::Init()
if (!exts) {
return Success;
}
// We only decode v3 extensions for v3 certificates for two reasons.
// 1. They make no sense in non-v3 certs
// 2. An invalid cert can embed a basic constraints extension and the
// check basic constrains will asume that this is valid. Making it
// posible to create chains with v1 and v2 intermediates with is
// not desirable.
if (! (nssCert->version.len == 1 &&
nssCert->version.data[0] == mozilla::pkix::der::Version::v3)) {
return Fail(RecoverableError, SEC_ERROR_EXTENSION_VALUE_INVALID);
}
const SECItem* dummyEncodedSubjectKeyIdentifier = nullptr;
const SECItem* dummyEncodedAuthorityKeyIdentifier = nullptr;