Add test certificate that overflows basicConstraints

This certificate is marlformed, but most implementations parse it as an
empty basicConstraints (thus not a CA), whereas current Mbed TLS parses it
as having basicConstraints containing CA:TRUE.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>

data_files/Makefile

@@ -2310,6 +2310,24 @@ parse_input/server4.crt server4.crt: server4.key
 		md=SHA256 version=3 output_file=$@
 all_final += server4.crt
 
+# Negative tests
+
+# Replace a well-formed basicConstraints extension containing CA:TRUE with
+# a malformed extension that is empty with trailing junk. The trailing
+# junk is a boolean with the value true, thus it would be interpreted as
+# CA:TRUE if it was properly inside the basicConstraints extension.
+parse_input/server5.basic-constraints-sequence-overflow.badsign.crt: server5-ca.der
+	perl -0777 -pe '$$n = s/\x04\x05\x30\x03\x01\x01\xff/\x04\x05\x30\x00\x01\x01\xff/g; die "More substitutions than expected" if $$n > 2; die "Substitution not found" if $$n < 1' <$< >$@.tmp
+	mv $@.tmp $@
+all_final: parse_input/server5.basic-constraints-sequence-overflow.badsign.crt
+
+parse_input/server5.basic-constraints-sequence-overflow.selfsigned.crt: parse_input/server5.basic-constraints-sequence-overflow.badsign.crt server5.key
+	$(OPENSSL) x509 -subj '/CN=Eve/' \
+		-key server5.key \
+		-days 3653 \
+		-inform DER -in $< -outform DER -out $@
+all_final: parse_input/server5.basic-constraints-sequence-overflow.selfsigned.crt
+
 # MD5 test certificate
 
 cert_md_test_key = $(cli_crt_key_file_rsa)