From d322eb96c3fafa6b7009eb1b31720f827784a56f Mon Sep 17 00:00:00 2001 From: Howard Chu Date: Mon, 24 Sep 2007 07:55:56 +0000 Subject: [PATCH] ITS#5151 fix CertificateListValidate --- servers/slapd/schema_init.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/servers/slapd/schema_init.c b/servers/slapd/schema_init.c index 9dd8642d3c..30b326a04e 100644 --- a/servers/slapd/schema_init.c +++ b/servers/slapd/schema_init.c @@ -222,21 +222,23 @@ static int certificateListValidate( Syntax *syntax, struct berval *in ) if ( tag != LBER_SEQUENCE ) return LDAP_INVALID_SYNTAX; ber_skip_data( ber, len ); tag = ber_skip_tag( ber, &len ); /* thisUpdate */ - /* NOTE: in the certificates I'm playing with, the time is UTC. - * maybe the tag is different from 0x17U for generalizedTime? */ - if ( tag != 0x17U ) return LDAP_INVALID_SYNTAX; + /* Time is a CHOICE { UTCTime, GeneralizedTime } */ + if ( tag != 0x17U && tag != 0x18U ) return LDAP_INVALID_SYNTAX; ber_skip_data( ber, len ); /* Optional nextUpdate */ tag = ber_skip_tag( ber, &len ); - if ( tag == 0x17U ) { + if ( tag == 0x17U || tag == 0x18U ) { ber_skip_data( ber, len ); tag = ber_skip_tag( ber, &len ); } - /* Optional revokedCertificates */ + /* revokedCertificates - Sequence of Sequence, Optional */ if ( tag == LBER_SEQUENCE ) { - /* Should NOT be empty */ - ber_skip_data( ber, len ); - tag = ber_skip_tag( ber, &len ); + ber_len_t seqlen; + if ( ber_peek_tag( ber, &seqlen ) == LBER_SEQUENCE ) { + /* Should NOT be empty */ + ber_skip_data( ber, len ); + tag = ber_skip_tag( ber, &len ); + } } /* Optional Extensions */ if ( tag == SLAP_X509_OPT_CL_CRLEXTENSIONS ) { /* ? */ -- 2.39.5