From 7c3c97ac13070a8aba2599262ef6c1f4b4446193 Mon Sep 17 00:00:00 2001 From: Hanno Becker Date: Thu, 5 Oct 2017 07:49:21 +0100 Subject: [PATCH] Don't add extensions for X.509 non-v3 certificates This commit removes extension-writing code for X.509 non-v3 certificates from x509write_crt_der. Previously, even if no extensions were present an empty sequence would have been added. --- library/x509write_crt.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/library/x509write_crt.c b/library/x509write_crt.c index b64499593e..a6b095a240 100644 --- a/library/x509write_crt.c +++ b/library/x509write_crt.c @@ -327,13 +327,19 @@ int x509write_crt_der( x509write_cert *ctx, unsigned char *buf, size_t size, /* * Extensions ::= SEQUENCE SIZE (1..MAX) OF Extension */ - ASN1_CHK_ADD( len, x509_write_extensions( &c, tmp_buf, ctx->extensions ) ); - ASN1_CHK_ADD( len, asn1_write_len( &c, tmp_buf, len ) ); - ASN1_CHK_ADD( len, asn1_write_tag( &c, tmp_buf, ASN1_CONSTRUCTED | - ASN1_SEQUENCE ) ); - ASN1_CHK_ADD( len, asn1_write_len( &c, tmp_buf, len ) ); - ASN1_CHK_ADD( len, asn1_write_tag( &c, tmp_buf, ASN1_CONTEXT_SPECIFIC | - ASN1_CONSTRUCTED | 3 ) ); + + /* Only for v3 */ + if( ctx->version == X509_CRT_VERSION_3 ) + { + ASN1_CHK_ADD( len, x509_write_extensions( &c, tmp_buf, + ctx->extensions ) ); + ASN1_CHK_ADD( len, asn1_write_len( &c, tmp_buf, len ) ); + ASN1_CHK_ADD( len, asn1_write_tag( &c, tmp_buf, ASN1_CONSTRUCTED | + ASN1_SEQUENCE ) ); + ASN1_CHK_ADD( len, asn1_write_len( &c, tmp_buf, len ) ); + ASN1_CHK_ADD( len, asn1_write_tag( &c, tmp_buf, ASN1_CONTEXT_SPECIFIC | + ASN1_CONSTRUCTED | 3 ) ); + } /* * SubjectPublicKeyInfo