1166129 - Crash at SSLServerCertVerification.cpp:1064 with certificates without extensions

Status: RESOLVED DUPLICATE of bug 1165911

(Core :: Security: PSM, defect)

Description

[Mike Hommey [:glandium]]

Code reads:
  for (size_t i = 0; endEntityCert->extensions[i]; i++) {

If extensions is NULL, which happens when the certificate doesn't have extensions and the CA that emitted the certificate is in the builtin token. I don't know if there are CAs in the default set that still emit certificates without extensions, but in Debian, we are adding the SPI CA certificate, and the certificate on mentors.debian.net doesn't have extensions, leading to a crash.

Comment 1

[Mike Hommey [:glandium]]

Attachment: Add a NULL-check for extensions on the end entity certificate when gathering EKU telemetry

Comment 2

[:Cykesiopka]

This is a dupe of Bug 1165911, but thanks for taking the time to make a patch anyways.