1039601 - Make parsing of certificates in OCSP responses clearer and more clearly safe

Status: RESOLVED FIXED

(Core :: Security: PSM, defect)

Description

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Attachment: use-DERArray-instead.patch

1. Use the bounds-checked DERArray class instead of doing our own bounds-checking on raw arrays.

2. Parse the wrappers and sequence in the same style as we parse other stuff in mozilla::pkix, instead of using the weird ExpectTagAndSkipLength.

3. Remove ExpectTagAndSkipLength.

Comment 1

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/68fe3e5c7181

Comment 2

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/68fe3e5c7181

Comment 3

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/68fe3e5c7181