185 	struct asn1_hdr hdr;  in x509_parse_algorithm_identifier()  local
195 	if (asn1_get_next(buf, len, &hdr) < 0 || !asn1_is_sequence(&hdr)) {  in x509_parse_algorithm_identifier()
196 		asn1_unexpected(&hdr,  in x509_parse_algorithm_identifier()
200 	if (hdr.length > buf + len - hdr.payload)  in x509_parse_algorithm_identifier()
202 	pos = hdr.payload;  in x509_parse_algorithm_identifier()
203 	end = pos + hdr.length;  in x509_parse_algorithm_identifier()
220 	struct asn1_hdr hdr;  in x509_parse_public_key()  local
233 	if (asn1_get_next(pos, end - pos, &hdr) < 0 ||  in x509_parse_public_key()
234 	    !asn1_is_sequence(&hdr)) {  in x509_parse_public_key()
235 		asn1_unexpected(&hdr,  in x509_parse_public_key()
239 	pos = hdr.payload;  in x509_parse_public_key()
241 	if (hdr.length > end - pos)  in x509_parse_public_key()
243 	end = pos + hdr.length;  in x509_parse_public_key()
250 	if (asn1_get_next(pos, end - pos, &hdr) < 0 ||  in x509_parse_public_key()
251 	    !asn1_is_bitstring(&hdr)) {  in x509_parse_public_key()
252 		asn1_unexpected(&hdr,  in x509_parse_public_key()
256 	if (hdr.length < 1)  in x509_parse_public_key()
258 	pos = hdr.payload;  in x509_parse_public_key()
271 	cert->public_key = os_memdup(pos + 1, hdr.length - 1);  in x509_parse_public_key()
277 	cert->public_key_len = hdr.length - 1;  in x509_parse_public_key()
288 	struct asn1_hdr hdr;  in x509_parse_name()  local
305 	if (asn1_get_next(buf, len, &hdr) < 0 || !asn1_is_sequence(&hdr)) {  in x509_parse_name()
306 		asn1_unexpected(&hdr,  in x509_parse_name()
310 	pos = hdr.payload;  in x509_parse_name()
312 	if (hdr.length > buf + len - pos)  in x509_parse_name()
315 	end = *next = pos + hdr.length;  in x509_parse_name()
320 		if (asn1_get_next(pos, end - pos, &hdr) < 0 ||  in x509_parse_name()
321 		    !asn1_is_set(&hdr)) {  in x509_parse_name()
322 			asn1_unexpected(&hdr,  in x509_parse_name()
328 		set_pos = hdr.payload;  in x509_parse_name()
329 		pos = set_end = hdr.payload + hdr.length;  in x509_parse_name()
331 		if (asn1_get_next(set_pos, set_end - set_pos, &hdr) < 0 ||  in x509_parse_name()
332 		    !asn1_is_sequence(&hdr)) {  in x509_parse_name()
333 			asn1_unexpected(&hdr,  in x509_parse_name()
339 		seq_pos = hdr.payload;  in x509_parse_name()
340 		seq_end = hdr.payload + hdr.length;  in x509_parse_name()
347 		if (asn1_get_next(seq_pos, seq_end - seq_pos, &hdr) < 0 ||  in x509_parse_name()
348 		    hdr.class != ASN1_CLASS_UNIVERSAL) {  in x509_parse_name()
355 		if (!asn1_is_string_type(&hdr)) {  in x509_parse_name()
358 				   hdr.tag);  in x509_parse_name()
407 			name->email = os_malloc(hdr.length + 1);  in x509_parse_name()
412 			os_memcpy(name->email, hdr.payload, hdr.length);  in x509_parse_name()
413 			name->email[hdr.length] = '\0';  in x509_parse_name()
429 					  hdr.payload, hdr.length);  in x509_parse_name()
439 		val = dup_binstr(hdr.payload, hdr.length);  in x509_parse_name()
444 		if (os_strlen(val) != hdr.length) {  in x509_parse_name()
693 	struct asn1_hdr hdr;  in x509_parse_validity()  local
709 	if (asn1_get_next(buf, len, &hdr) < 0 || !asn1_is_sequence(&hdr)) {  in x509_parse_validity()
710 		asn1_unexpected(&hdr, "X509: Expected SEQUENCE (Validity)");  in x509_parse_validity()
713 	pos = hdr.payload;  in x509_parse_validity()
714 	plen = hdr.length;  in x509_parse_validity()
721 	if (asn1_get_next(pos, plen, &hdr) < 0 ||  in x509_parse_validity()
722 	    (!asn1_is_utctime(&hdr) && !asn1_is_generalizedtime(&hdr)) ||  in x509_parse_validity()
723 	    x509_parse_time(hdr.payload, hdr.length, hdr.tag,  in x509_parse_validity()
726 				  "Time", hdr.payload, hdr.length);  in x509_parse_validity()
730 	pos = hdr.payload + hdr.length;  in x509_parse_validity()
733 	if (asn1_get_next(pos, plen, &hdr) < 0 ||  in x509_parse_validity()
734 	    (!asn1_is_utctime(&hdr) && !asn1_is_generalizedtime(&hdr)) ||  in x509_parse_validity()
735 	    x509_parse_time(hdr.payload, hdr.length, hdr.tag,  in x509_parse_validity()
738 				  "Time", hdr.payload, hdr.length);  in x509_parse_validity()
772 	struct asn1_hdr hdr;  in x509_parse_ext_key_usage()  local
787 	if (asn1_get_next(pos, len, &hdr) < 0 || !asn1_is_bitstring(&hdr) ||  in x509_parse_ext_key_usage()
788 	    hdr.length < 1) {  in x509_parse_ext_key_usage()
789 		asn1_unexpected(&hdr, "X509: Expected BIT STRING in KeyUsage");  in x509_parse_ext_key_usage()
794 	cert->key_usage = asn1_bit_string_to_long(hdr.payload, hdr.length);  in x509_parse_ext_key_usage()
805 	struct asn1_hdr hdr;  in x509_parse_ext_basic_constraints()  local
816 	if (asn1_get_next(pos, len, &hdr) < 0 || !asn1_is_sequence(&hdr)) {  in x509_parse_ext_basic_constraints()
817 		asn1_unexpected(&hdr,  in x509_parse_ext_basic_constraints()
824 	if (hdr.length == 0)  in x509_parse_ext_basic_constraints()
827 	end_seq = hdr.payload + hdr.length;  in x509_parse_ext_basic_constraints()
828 	if (asn1_get_next(hdr.payload, hdr.length, &hdr) < 0) {  in x509_parse_ext_basic_constraints()
834 	if (asn1_is_boolean(&hdr)) {  in x509_parse_ext_basic_constraints()
835 		cert->ca = hdr.payload[0];  in x509_parse_ext_basic_constraints()
837 		pos = hdr.payload + hdr.length;  in x509_parse_ext_basic_constraints()
844 		if (asn1_get_next(pos, end_seq - pos, &hdr) < 0) {  in x509_parse_ext_basic_constraints()
851 	if (!asn1_is_integer(&hdr)) {  in x509_parse_ext_basic_constraints()
852 		asn1_unexpected(&hdr,  in x509_parse_ext_basic_constraints()
857 	pos = hdr.payload;  in x509_parse_ext_basic_constraints()
858 	left = hdr.length;  in x509_parse_ext_basic_constraints()
978 	struct asn1_hdr hdr;  in x509_parse_ext_alt_name()  local
1004 	for (p = pos, end = pos + len; p < end; p = hdr.payload + hdr.length) {  in x509_parse_ext_alt_name()
1007 		if (asn1_get_next(p, end - p, &hdr) < 0) {  in x509_parse_ext_alt_name()
1013 		if (hdr.class != ASN1_CLASS_CONTEXT_SPECIFIC)  in x509_parse_ext_alt_name()
1016 		switch (hdr.tag) {  in x509_parse_ext_alt_name()
1018 			res = x509_parse_alt_name_rfc8222(name, hdr.payload,  in x509_parse_ext_alt_name()
1019 							  hdr.length);  in x509_parse_ext_alt_name()
1022 			res = x509_parse_alt_name_dns(name, hdr.payload,  in x509_parse_ext_alt_name()
1023 						      hdr.length);  in x509_parse_ext_alt_name()
1026 			res = x509_parse_alt_name_uri(name, hdr.payload,  in x509_parse_ext_alt_name()
1027 						      hdr.length);  in x509_parse_ext_alt_name()
1030 			res = x509_parse_alt_name_ip(name, hdr.payload,  in x509_parse_ext_alt_name()
1031 						     hdr.length);  in x509_parse_ext_alt_name()
1034 			res = x509_parse_alt_name_rid(name, hdr.payload,  in x509_parse_ext_alt_name()
1035 						      hdr.length);  in x509_parse_ext_alt_name()
1056 	struct asn1_hdr hdr;  in x509_parse_ext_subject_alt_name()  local
1060 	if (asn1_get_next(pos, len, &hdr) < 0 || !asn1_is_sequence(&hdr)) {  in x509_parse_ext_subject_alt_name()
1061 		asn1_unexpected(&hdr,  in x509_parse_ext_subject_alt_name()
1069 	if (hdr.length == 0)  in x509_parse_ext_subject_alt_name()
1072 	return x509_parse_ext_alt_name(&cert->subject, hdr.payload,  in x509_parse_ext_subject_alt_name()
1073 				       hdr.length);  in x509_parse_ext_subject_alt_name()
1080 	struct asn1_hdr hdr;  in x509_parse_ext_issuer_alt_name()  local
1084 	if (asn1_get_next(pos, len, &hdr) < 0 || !asn1_is_sequence(&hdr)) {  in x509_parse_ext_issuer_alt_name()
1085 		asn1_unexpected(&hdr,  in x509_parse_ext_issuer_alt_name()
1093 	if (hdr.length == 0)  in x509_parse_ext_issuer_alt_name()
1096 	return x509_parse_ext_alt_name(&cert->issuer, hdr.payload,  in x509_parse_ext_issuer_alt_name()
1097 				       hdr.length);  in x509_parse_ext_issuer_alt_name()
1153 	struct asn1_hdr hdr;  in x509_parse_ext_certificate_policies()  local
1167 	if (asn1_get_next(pos, len, &hdr) < 0 || !asn1_is_sequence(&hdr)) {  in x509_parse_ext_certificate_policies()
1168 		asn1_unexpected(&hdr,  in x509_parse_ext_certificate_policies()
1172 	if (hdr.length > pos + len - hdr.payload)  in x509_parse_ext_certificate_policies()
1174 	pos = hdr.payload;  in x509_parse_ext_certificate_policies()
1175 	end = pos + hdr.length;  in x509_parse_ext_certificate_policies()
1184 		if (asn1_get_next(pos, end - pos, &hdr) < 0 ||  in x509_parse_ext_certificate_policies()
1185 		    !asn1_is_sequence(&hdr)) {  in x509_parse_ext_certificate_policies()
1186 			asn1_unexpected(&hdr,  in x509_parse_ext_certificate_policies()
1190 		if (hdr.length > end - hdr.payload)  in x509_parse_ext_certificate_policies()
1192 		pos = hdr.payload;  in x509_parse_ext_certificate_policies()
1193 		pol_end = pos + hdr.length;  in x509_parse_ext_certificate_policies()
1277 	struct asn1_hdr hdr;  in x509_parse_ext_ext_key_usage()  local
1287 	if (asn1_get_next(pos, len, &hdr) < 0 || !asn1_is_sequence(&hdr)) {  in x509_parse_ext_ext_key_usage()
1288 		asn1_unexpected(&hdr,  in x509_parse_ext_ext_key_usage()
1292 	if (hdr.length > pos + len - hdr.payload)  in x509_parse_ext_ext_key_usage()
1294 	pos = hdr.payload;  in x509_parse_ext_ext_key_usage()
1295 	end = pos + hdr.length;  in x509_parse_ext_ext_key_usage()
1363 	struct asn1_hdr hdr;  in x509_parse_extension()  local
1376 	if (asn1_get_next(pos, len, &hdr) < 0 || !asn1_is_sequence(&hdr)) {  in x509_parse_extension()
1377 		asn1_unexpected(&hdr, "X509: Expected SEQUENCE in Extensions");  in x509_parse_extension()
1380 	pos = hdr.payload;  in x509_parse_extension()
1381 	*next = end = pos + hdr.length;  in x509_parse_extension()
1389 	if (asn1_get_next(pos, end - pos, &hdr) < 0 ||  in x509_parse_extension()
1390 	    (!asn1_is_boolean(&hdr) && !asn1_is_octetstring(&hdr))) {  in x509_parse_extension()
1391 		asn1_unexpected(&hdr,  in x509_parse_extension()
1396 	if (hdr.tag == ASN1_TAG_BOOLEAN) {  in x509_parse_extension()
1397 		critical_ext = hdr.payload[0];  in x509_parse_extension()
1398 		pos = hdr.payload;  in x509_parse_extension()
1405 		if (asn1_get_next(pos, end - pos, &hdr) < 0 ||  in x509_parse_extension()
1406 		    (!asn1_is_octetstring(&hdr) &&  in x509_parse_extension()
1407 		     !(hdr.class == ASN1_CLASS_PRIVATE &&  in x509_parse_extension()
1408 		       hdr.tag == ASN1_TAG_OCTETSTRING))) {  in x509_parse_extension()
1409 			asn1_unexpected(&hdr,  in x509_parse_extension()
1418 	wpa_hexdump(MSG_MSGDUMP, "X509: extnValue", hdr.payload, hdr.length);  in x509_parse_extension()
1420 	res = x509_parse_extension_data(cert, &oid, hdr.payload, hdr.length);  in x509_parse_extension()
1437 	struct asn1_hdr hdr;  in x509_parse_extensions()  local
1441 	if (asn1_get_next(pos, len, &hdr) < 0 || !asn1_is_sequence(&hdr)) {  in x509_parse_extensions()
1442 		asn1_unexpected(&hdr, "X509: Expected SEQUENCE for Extensions");  in x509_parse_extensions()
1446 	pos = hdr.payload;  in x509_parse_extensions()
1447 	end = pos + hdr.length;  in x509_parse_extensions()
1463 	struct asn1_hdr hdr;  in x509_parse_tbs_certificate()  local
1471 	if (asn1_get_next(buf, len, &hdr) < 0 || !asn1_is_sequence(&hdr)) {  in x509_parse_tbs_certificate()
1472 		asn1_unexpected(&hdr,  in x509_parse_tbs_certificate()
1476 	pos = hdr.payload;  in x509_parse_tbs_certificate()
1477 	end = *next = pos + hdr.length;  in x509_parse_tbs_certificate()
1483 	if (asn1_get_next(pos, end - pos, &hdr) < 0)  in x509_parse_tbs_certificate()
1485 	pos = hdr.payload;  in x509_parse_tbs_certificate()
1487 	if (asn1_is_cs_tag(&hdr, 0) && hdr.constructed) {  in x509_parse_tbs_certificate()
1488 		if (asn1_get_next(pos, end - pos, &hdr) < 0 ||  in x509_parse_tbs_certificate()
1489 		    !asn1_is_integer(&hdr)) {  in x509_parse_tbs_certificate()
1490 			asn1_unexpected(&hdr,  in x509_parse_tbs_certificate()
1494 		if (hdr.length != 1) {  in x509_parse_tbs_certificate()
1496 				   "length %u (expected 1)", hdr.length);  in x509_parse_tbs_certificate()
1499 		pos = hdr.payload;  in x509_parse_tbs_certificate()
1500 		left = hdr.length;  in x509_parse_tbs_certificate()
1517 		if (asn1_get_next(pos, end - pos, &hdr) < 0)  in x509_parse_tbs_certificate()
1524 	if (!asn1_is_integer(&hdr) ||  in x509_parse_tbs_certificate()
1525 	    hdr.length < 1 || hdr.length > X509_MAX_SERIAL_NUM_LEN) {  in x509_parse_tbs_certificate()
1526 		asn1_unexpected(&hdr,  in x509_parse_tbs_certificate()
1531 	pos = hdr.payload + hdr.length;  in x509_parse_tbs_certificate()
1532 	while (hdr.length > 0 && hdr.payload[0] == 0) {  in x509_parse_tbs_certificate()
1533 		hdr.payload++;  in x509_parse_tbs_certificate()
1534 		hdr.length--;  in x509_parse_tbs_certificate()
1536 	os_memcpy(cert->serial_number, hdr.payload, hdr.length);  in x509_parse_tbs_certificate()
1537 	cert->serial_number_len = hdr.length;  in x509_parse_tbs_certificate()
1578 	if (asn1_get_next(pos, end - pos, &hdr) < 0 ||  in x509_parse_tbs_certificate()
1579 	    hdr.class != ASN1_CLASS_CONTEXT_SPECIFIC) {  in x509_parse_tbs_certificate()
1580 		asn1_unexpected(&hdr,  in x509_parse_tbs_certificate()
1585 	if (hdr.tag == 1) {  in x509_parse_tbs_certificate()
1590 		pos = hdr.payload + hdr.length;  in x509_parse_tbs_certificate()
1594 		if (asn1_get_next(pos, end - pos, &hdr) < 0 ||  in x509_parse_tbs_certificate()
1595 		    hdr.class != ASN1_CLASS_CONTEXT_SPECIFIC) {  in x509_parse_tbs_certificate()
1596 			asn1_unexpected(&hdr,  in x509_parse_tbs_certificate()
1602 	if (hdr.tag == 2) {  in x509_parse_tbs_certificate()
1607 		pos = hdr.payload + hdr.length;  in x509_parse_tbs_certificate()
1611 		if (asn1_get_next(pos, end - pos, &hdr) < 0 ||  in x509_parse_tbs_certificate()
1612 		    hdr.class != ASN1_CLASS_CONTEXT_SPECIFIC) {  in x509_parse_tbs_certificate()
1613 			asn1_unexpected(&hdr,  in x509_parse_tbs_certificate()
1619 	if (hdr.tag != 3) {  in x509_parse_tbs_certificate()
1622 			   hdr.constructed, hdr.tag);  in x509_parse_tbs_certificate()
1635 	if (x509_parse_extensions(cert, hdr.payload, hdr.length) < 0)  in x509_parse_tbs_certificate()
1638 	pos = hdr.payload + hdr.length;  in x509_parse_tbs_certificate()
1733 	struct asn1_hdr hdr;  in x509_certificate_parse()  local
1750 	if (asn1_get_next(pos, len, &hdr) < 0 || !asn1_is_sequence(&hdr)) {  in x509_certificate_parse()
1751 		asn1_unexpected(&hdr,  in x509_certificate_parse()
1756 	pos = hdr.payload;  in x509_certificate_parse()
1758 	if (hdr.length > end - pos) {  in x509_certificate_parse()
1763 	if (hdr.length < end - pos) {  in x509_certificate_parse()
1766 			    pos + hdr.length, end - (pos + hdr.length));  in x509_certificate_parse()
1767 		end = pos + hdr.length;  in x509_certificate_parse()
1786 	if (asn1_get_next(pos, end - pos, &hdr) < 0 ||  in x509_certificate_parse()
1787 	    !asn1_is_bitstring(&hdr)) {  in x509_certificate_parse()
1788 		asn1_unexpected(&hdr,  in x509_certificate_parse()
1793 	if (hdr.length < 1) {  in x509_certificate_parse()
1797 	pos = hdr.payload;  in x509_certificate_parse()
1810 	cert->sign_value = os_memdup(pos + 1, hdr.length - 1);  in x509_certificate_parse()
1817 	cert->sign_value_len = hdr.length - 1;  in x509_certificate_parse()
1850 	struct asn1_hdr hdr;  in x509_check_signature()  local
1902 	if (asn1_get_next(data, data_len, &hdr) < 0 ||  in x509_check_signature()
1903 	    !asn1_is_sequence(&hdr)) {  in x509_check_signature()
1904 		asn1_unexpected(&hdr, "X509: Expected SEQUENCE (DigestInfo)");  in x509_check_signature()
1908 	wpa_hexdump(MSG_MSGDUMP, "X509: DigestInfo", hdr.payload, hdr.length);  in x509_check_signature()
1910 	pos = hdr.payload;  in x509_check_signature()
1911 	end = pos + hdr.length;  in x509_check_signature()
1921 	if (asn1_get_next(pos, end - pos, &hdr) < 0 ||  in x509_check_signature()
1922 	    !asn1_is_sequence(&hdr)) {  in x509_check_signature()
1923 		asn1_unexpected(&hdr,  in x509_check_signature()
1929 		    hdr.payload, hdr.length);  in x509_check_signature()
1930 	da_end = hdr.payload + hdr.length;  in x509_check_signature()
1932 	if (asn1_get_oid(hdr.payload, hdr.length, &oid, &next)) {  in x509_check_signature()
1946 	    (asn1_get_next(next, da_end - next, &hdr) < 0 ||  in x509_check_signature()
1947 	     !asn1_is_null(&hdr) ||  in x509_check_signature()
1948 	     hdr.payload + hdr.length != da_end)) {  in x509_check_signature()
2033 	if (asn1_get_next(pos, end - pos, &hdr) < 0 ||  in x509_check_signature()
2034 	    !asn1_is_octetstring(&hdr)) {  in x509_check_signature()
2035 		asn1_unexpected(&hdr, "X509: Expected OCTETSTRING (Digest)");  in x509_check_signature()
2040 		    hdr.payload, hdr.length);  in x509_check_signature()
2081 	if (hdr.length != hash_len ||  in x509_check_signature()
2082 	    os_memcmp_const(hdr.payload, hash, hdr.length) != 0) {  in x509_check_signature()
2089 	if (hdr.payload + hdr.length < data + data_len) {  in x509_check_signature()
2092 			    hdr.payload + hdr.length,  in x509_check_signature()
2093 			    data + data_len - hdr.payload - hdr.length);  in x509_check_signature()