Re: [PATCH 2/4] X.509: Parse Basic Constraints for CA

[Eric Snowberg]

> On Mar 4, 2022, at 8:10 AM, Stefan Berger <stefanb@xxxxxxxxxxxxx> wrote:
> 
> 
> On 3/1/22 12:36, Eric Snowberg wrote:
>> Parse the X.509 Basic Constraints.  The basic constraints extension
>> identifies whether the subject of the certificate is a CA.
>> 
>> BasicConstraints ::= SEQUENCE {
>>         cA                      BOOLEAN DEFAULT FALSE,
>>         pathLenConstraint       INTEGER (0..MAX) OPTIONAL }
>> 
>> If the CA is true, store it in a new public_key field call key_is_ca.
>> This will be used in a follow on patch that requires knowing if the
>> public key is a CA.
>> 
>> Signed-off-by: Eric Snowberg <eric.snowberg@xxxxxxxxxx>
>> ---
>>  crypto/asymmetric_keys/x509_cert_parser.c | 9 +++++++++
>>  include/crypto/public_key.h               | 1 +
>>  2 files changed, 10 insertions(+)
>> 
>> diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c
>> index 2899ed80bb18..38c907f4ce27 100644
>> --- a/crypto/asymmetric_keys/x509_cert_parser.c
>> +++ b/crypto/asymmetric_keys/x509_cert_parser.c
>> @@ -583,6 +583,15 @@ int x509_process_extension(void *context, size_t hdrlen,
>>  		return 0;
>>  	}
>>  +	if (ctx->last_oid == OID_basicConstraints) {
> 
> Don't you have to check whether you can access v[0] and v[1]?

Good catch, I’ll add the check

> if (vlen < 3)
> 
>     return -EBADMSG;

I think this would be best

> or should it even be
> 
> if (vlen != 3)
> 
>      return -EBADMSG;

since the length could be larger than 3 if the optional pathLenConstraint
is supplied.