185 	struct asn1_hdr hdr;  in x509_parse_algorithm_identifier()  local
195 	if (asn1_get_next(buf, len, &hdr) < 0 || !asn1_is_sequence(&hdr)) {  in x509_parse_algorithm_identifier()
196 		asn1_unexpected(&hdr,  in x509_parse_algorithm_identifier()
200 	if (hdr.length > buf + len - hdr.payload)  in x509_parse_algorithm_identifier()
202 	pos = hdr.payload;  in x509_parse_algorithm_identifier()
203 	end = pos + hdr.length;  in x509_parse_algorithm_identifier()
220 	struct asn1_hdr hdr;  in x509_parse_public_key()  local
233 	if (asn1_get_next(pos, end - pos, &hdr) < 0 ||  in x509_parse_public_key()
234 	    !asn1_is_sequence(&hdr)) {  in x509_parse_public_key()
235 		asn1_unexpected(&hdr,  in x509_parse_public_key()
239 	pos = hdr.payload;  in x509_parse_public_key()
241 	if (hdr.length > end - pos)  in x509_parse_public_key()
243 	end = pos + hdr.length;  in x509_parse_public_key()
250 	if (asn1_get_next(pos, end - pos, &hdr) < 0 ||  in x509_parse_public_key()
251 	    !asn1_is_bitstring(&hdr)) {  in x509_parse_public_key()
252 		asn1_unexpected(&hdr,  in x509_parse_public_key()
256 	if (hdr.length < 1)  in x509_parse_public_key()
258 	pos = hdr.payload;  in x509_parse_public_key()
271 	cert->public_key = os_memdup(pos + 1, hdr.length - 1);  in x509_parse_public_key()
277 	cert->public_key_len = hdr.length - 1;  in x509_parse_public_key()
288 	struct asn1_hdr hdr;  in x509_parse_name()  local
305 	if (asn1_get_next(buf, len, &hdr) < 0 || !asn1_is_sequence(&hdr)) {  in x509_parse_name()
306 		asn1_unexpected(&hdr,  in x509_parse_name()
310 	pos = hdr.payload;  in x509_parse_name()
312 	if (hdr.length > buf + len - pos)  in x509_parse_name()
315 	end = *next = pos + hdr.length;  in x509_parse_name()
320 		if (asn1_get_next(pos, end - pos, &hdr) < 0 ||  in x509_parse_name()
321 		    !asn1_is_set(&hdr)) {  in x509_parse_name()
322 			asn1_unexpected(&hdr,  in x509_parse_name()
328 		set_pos = hdr.payload;  in x509_parse_name()
329 		pos = set_end = hdr.payload + hdr.length;  in x509_parse_name()
331 		if (asn1_get_next(set_pos, set_end - set_pos, &hdr) < 0 ||  in x509_parse_name()
332 		    !asn1_is_sequence(&hdr)) {  in x509_parse_name()
333 			asn1_unexpected(&hdr,  in x509_parse_name()
339 		seq_pos = hdr.payload;  in x509_parse_name()
340 		seq_end = hdr.payload + hdr.length;  in x509_parse_name()
347 		if (asn1_get_next(seq_pos, seq_end - seq_pos, &hdr) < 0 ||  in x509_parse_name()
348 		    hdr.class != ASN1_CLASS_UNIVERSAL) {  in x509_parse_name()
355 		if (!asn1_is_string_type(&hdr)) {  in x509_parse_name()
358 				   hdr.tag);  in x509_parse_name()
407 			name->email = os_malloc(hdr.length + 1);  in x509_parse_name()
412 			os_memcpy(name->email, hdr.payload, hdr.length);  in x509_parse_name()
413 			name->email[hdr.length] = '\0';  in x509_parse_name()
429 					  hdr.payload, hdr.length);  in x509_parse_name()
439 		val = dup_binstr(hdr.payload, hdr.length);  in x509_parse_name()
444 		if (os_strlen(val) != hdr.length) {  in x509_parse_name()
689 	struct asn1_hdr hdr;  in x509_parse_validity()  local
705 	if (asn1_get_next(buf, len, &hdr) < 0 || !asn1_is_sequence(&hdr)) {  in x509_parse_validity()
706 		asn1_unexpected(&hdr, "X509: Expected SEQUENCE (Validity)");  in x509_parse_validity()
709 	pos = hdr.payload;  in x509_parse_validity()
710 	plen = hdr.length;  in x509_parse_validity()
717 	if (asn1_get_next(pos, plen, &hdr) < 0 ||  in x509_parse_validity()
718 	    (!asn1_is_utctime(&hdr) && !asn1_is_generalizedtime(&hdr)) ||  in x509_parse_validity()
719 	    x509_parse_time(hdr.payload, hdr.length, hdr.tag,  in x509_parse_validity()
722 				  "Time", hdr.payload, hdr.length);  in x509_parse_validity()
726 	pos = hdr.payload + hdr.length;  in x509_parse_validity()
729 	if (asn1_get_next(pos, plen, &hdr) < 0 ||  in x509_parse_validity()
730 	    (!asn1_is_utctime(&hdr) && !asn1_is_generalizedtime(&hdr)) ||  in x509_parse_validity()
731 	    x509_parse_time(hdr.payload, hdr.length, hdr.tag,  in x509_parse_validity()
734 				  "Time", hdr.payload, hdr.length);  in x509_parse_validity()
768 	struct asn1_hdr hdr;  in x509_parse_ext_key_usage()  local
783 	if (asn1_get_next(pos, len, &hdr) < 0 || !asn1_is_bitstring(&hdr) ||  in x509_parse_ext_key_usage()
784 	    hdr.length < 1) {  in x509_parse_ext_key_usage()
785 		asn1_unexpected(&hdr, "X509: Expected BIT STRING in KeyUsage");  in x509_parse_ext_key_usage()
790 	cert->key_usage = asn1_bit_string_to_long(hdr.payload, hdr.length);  in x509_parse_ext_key_usage()
801 	struct asn1_hdr hdr;  in x509_parse_ext_basic_constraints()  local
812 	if (asn1_get_next(pos, len, &hdr) < 0 || !asn1_is_sequence(&hdr)) {  in x509_parse_ext_basic_constraints()
813 		asn1_unexpected(&hdr,  in x509_parse_ext_basic_constraints()
820 	if (hdr.length == 0)  in x509_parse_ext_basic_constraints()
823 	end_seq = hdr.payload + hdr.length;  in x509_parse_ext_basic_constraints()
824 	if (asn1_get_next(hdr.payload, hdr.length, &hdr) < 0) {  in x509_parse_ext_basic_constraints()
830 	if (asn1_is_boolean(&hdr)) {  in x509_parse_ext_basic_constraints()
831 		cert->ca = hdr.payload[0];  in x509_parse_ext_basic_constraints()
833 		pos = hdr.payload + hdr.length;  in x509_parse_ext_basic_constraints()
840 		if (asn1_get_next(pos, end_seq - pos, &hdr) < 0) {  in x509_parse_ext_basic_constraints()
847 	if (!asn1_is_integer(&hdr)) {  in x509_parse_ext_basic_constraints()
848 		asn1_unexpected(&hdr,  in x509_parse_ext_basic_constraints()
853 	pos = hdr.payload;  in x509_parse_ext_basic_constraints()
854 	left = hdr.length;  in x509_parse_ext_basic_constraints()
974 	struct asn1_hdr hdr;  in x509_parse_ext_alt_name()  local
1000 	for (p = pos, end = pos + len; p < end; p = hdr.payload + hdr.length) {  in x509_parse_ext_alt_name()
1003 		if (asn1_get_next(p, end - p, &hdr) < 0) {  in x509_parse_ext_alt_name()
1009 		if (hdr.class != ASN1_CLASS_CONTEXT_SPECIFIC)  in x509_parse_ext_alt_name()
1012 		switch (hdr.tag) {  in x509_parse_ext_alt_name()
1014 			res = x509_parse_alt_name_rfc8222(name, hdr.payload,  in x509_parse_ext_alt_name()
1015 							  hdr.length);  in x509_parse_ext_alt_name()
1018 			res = x509_parse_alt_name_dns(name, hdr.payload,  in x509_parse_ext_alt_name()
1019 						      hdr.length);  in x509_parse_ext_alt_name()
1022 			res = x509_parse_alt_name_uri(name, hdr.payload,  in x509_parse_ext_alt_name()
1023 						      hdr.length);  in x509_parse_ext_alt_name()
1026 			res = x509_parse_alt_name_ip(name, hdr.payload,  in x509_parse_ext_alt_name()
1027 						     hdr.length);  in x509_parse_ext_alt_name()
1030 			res = x509_parse_alt_name_rid(name, hdr.payload,  in x509_parse_ext_alt_name()
1031 						      hdr.length);  in x509_parse_ext_alt_name()
1052 	struct asn1_hdr hdr;  in x509_parse_ext_subject_alt_name()  local
1056 	if (asn1_get_next(pos, len, &hdr) < 0 || !asn1_is_sequence(&hdr)) {  in x509_parse_ext_subject_alt_name()
1057 		asn1_unexpected(&hdr,  in x509_parse_ext_subject_alt_name()
1065 	if (hdr.length == 0)  in x509_parse_ext_subject_alt_name()
1068 	return x509_parse_ext_alt_name(&cert->subject, hdr.payload,  in x509_parse_ext_subject_alt_name()
1069 				       hdr.length);  in x509_parse_ext_subject_alt_name()
1076 	struct asn1_hdr hdr;  in x509_parse_ext_issuer_alt_name()  local
1080 	if (asn1_get_next(pos, len, &hdr) < 0 || !asn1_is_sequence(&hdr)) {  in x509_parse_ext_issuer_alt_name()
1081 		asn1_unexpected(&hdr,  in x509_parse_ext_issuer_alt_name()
1089 	if (hdr.length == 0)  in x509_parse_ext_issuer_alt_name()
1092 	return x509_parse_ext_alt_name(&cert->issuer, hdr.payload,  in x509_parse_ext_issuer_alt_name()
1093 				       hdr.length);  in x509_parse_ext_issuer_alt_name()
1149 	struct asn1_hdr hdr;  in x509_parse_ext_certificate_policies()  local
1163 	if (asn1_get_next(pos, len, &hdr) < 0 || !asn1_is_sequence(&hdr)) {  in x509_parse_ext_certificate_policies()
1164 		asn1_unexpected(&hdr,  in x509_parse_ext_certificate_policies()
1168 	if (hdr.length > pos + len - hdr.payload)  in x509_parse_ext_certificate_policies()
1170 	pos = hdr.payload;  in x509_parse_ext_certificate_policies()
1171 	end = pos + hdr.length;  in x509_parse_ext_certificate_policies()
1180 		if (asn1_get_next(pos, end - pos, &hdr) < 0 ||  in x509_parse_ext_certificate_policies()
1181 		    !asn1_is_sequence(&hdr)) {  in x509_parse_ext_certificate_policies()
1182 			asn1_unexpected(&hdr,  in x509_parse_ext_certificate_policies()
1186 		if (hdr.length > end - hdr.payload)  in x509_parse_ext_certificate_policies()
1188 		pos = hdr.payload;  in x509_parse_ext_certificate_policies()
1189 		pol_end = pos + hdr.length;  in x509_parse_ext_certificate_policies()
1273 	struct asn1_hdr hdr;  in x509_parse_ext_ext_key_usage()  local
1283 	if (asn1_get_next(pos, len, &hdr) < 0 || !asn1_is_sequence(&hdr)) {  in x509_parse_ext_ext_key_usage()
1284 		asn1_unexpected(&hdr,  in x509_parse_ext_ext_key_usage()
1288 	if (hdr.length > pos + len - hdr.payload)  in x509_parse_ext_ext_key_usage()
1290 	pos = hdr.payload;  in x509_parse_ext_ext_key_usage()
1291 	end = pos + hdr.length;  in x509_parse_ext_ext_key_usage()
1359 	struct asn1_hdr hdr;  in x509_parse_extension()  local
1372 	if (asn1_get_next(pos, len, &hdr) < 0 || !asn1_is_sequence(&hdr)) {  in x509_parse_extension()
1373 		asn1_unexpected(&hdr, "X509: Expected SEQUENCE in Extensions");  in x509_parse_extension()
1376 	pos = hdr.payload;  in x509_parse_extension()
1377 	*next = end = pos + hdr.length;  in x509_parse_extension()
1385 	if (asn1_get_next(pos, end - pos, &hdr) < 0 ||  in x509_parse_extension()
1386 	    (!asn1_is_boolean(&hdr) && !asn1_is_octetstring(&hdr))) {  in x509_parse_extension()
1387 		asn1_unexpected(&hdr,  in x509_parse_extension()
1392 	if (hdr.tag == ASN1_TAG_BOOLEAN) {  in x509_parse_extension()
1393 		critical_ext = hdr.payload[0];  in x509_parse_extension()
1394 		pos = hdr.payload;  in x509_parse_extension()
1401 		if (asn1_get_next(pos, end - pos, &hdr) < 0 ||  in x509_parse_extension()
1402 		    (!asn1_is_octetstring(&hdr) &&  in x509_parse_extension()
1403 		     !(hdr.class == ASN1_CLASS_PRIVATE &&  in x509_parse_extension()
1404 		       hdr.tag == ASN1_TAG_OCTETSTRING))) {  in x509_parse_extension()
1405 			asn1_unexpected(&hdr,  in x509_parse_extension()
1414 	wpa_hexdump(MSG_MSGDUMP, "X509: extnValue", hdr.payload, hdr.length);  in x509_parse_extension()
1416 	res = x509_parse_extension_data(cert, &oid, hdr.payload, hdr.length);  in x509_parse_extension()
1433 	struct asn1_hdr hdr;  in x509_parse_extensions()  local
1437 	if (asn1_get_next(pos, len, &hdr) < 0 || !asn1_is_sequence(&hdr)) {  in x509_parse_extensions()
1438 		asn1_unexpected(&hdr, "X509: Expected SEQUENCE for Extensions");  in x509_parse_extensions()
1442 	pos = hdr.payload;  in x509_parse_extensions()
1443 	end = pos + hdr.length;  in x509_parse_extensions()
1459 	struct asn1_hdr hdr;  in x509_parse_tbs_certificate()  local
1467 	if (asn1_get_next(buf, len, &hdr) < 0 || !asn1_is_sequence(&hdr)) {  in x509_parse_tbs_certificate()
1468 		asn1_unexpected(&hdr,  in x509_parse_tbs_certificate()
1472 	pos = hdr.payload;  in x509_parse_tbs_certificate()
1473 	end = *next = pos + hdr.length;  in x509_parse_tbs_certificate()
1479 	if (asn1_get_next(pos, end - pos, &hdr) < 0)  in x509_parse_tbs_certificate()
1481 	pos = hdr.payload;  in x509_parse_tbs_certificate()
1483 	if (asn1_is_cs_tag(&hdr, 0) && hdr.constructed) {  in x509_parse_tbs_certificate()
1484 		if (asn1_get_next(pos, end - pos, &hdr) < 0 ||  in x509_parse_tbs_certificate()
1485 		    !asn1_is_integer(&hdr)) {  in x509_parse_tbs_certificate()
1486 			asn1_unexpected(&hdr,  in x509_parse_tbs_certificate()
1490 		if (hdr.length != 1) {  in x509_parse_tbs_certificate()
1492 				   "length %u (expected 1)", hdr.length);  in x509_parse_tbs_certificate()
1495 		pos = hdr.payload;  in x509_parse_tbs_certificate()
1496 		left = hdr.length;  in x509_parse_tbs_certificate()
1513 		if (asn1_get_next(pos, end - pos, &hdr) < 0)  in x509_parse_tbs_certificate()
1520 	if (!asn1_is_integer(&hdr) ||  in x509_parse_tbs_certificate()
1521 	    hdr.length < 1 || hdr.length > X509_MAX_SERIAL_NUM_LEN) {  in x509_parse_tbs_certificate()
1522 		asn1_unexpected(&hdr,  in x509_parse_tbs_certificate()
1527 	pos = hdr.payload + hdr.length;  in x509_parse_tbs_certificate()
1528 	while (hdr.length > 0 && hdr.payload[0] == 0) {  in x509_parse_tbs_certificate()
1529 		hdr.payload++;  in x509_parse_tbs_certificate()
1530 		hdr.length--;  in x509_parse_tbs_certificate()
1532 	os_memcpy(cert->serial_number, hdr.payload, hdr.length);  in x509_parse_tbs_certificate()
1533 	cert->serial_number_len = hdr.length;  in x509_parse_tbs_certificate()
1574 	if (asn1_get_next(pos, end - pos, &hdr) < 0 ||  in x509_parse_tbs_certificate()
1575 	    hdr.class != ASN1_CLASS_CONTEXT_SPECIFIC) {  in x509_parse_tbs_certificate()
1576 		asn1_unexpected(&hdr,  in x509_parse_tbs_certificate()
1581 	if (hdr.tag == 1) {  in x509_parse_tbs_certificate()
1586 		pos = hdr.payload + hdr.length;  in x509_parse_tbs_certificate()
1590 		if (asn1_get_next(pos, end - pos, &hdr) < 0 ||  in x509_parse_tbs_certificate()
1591 		    hdr.class != ASN1_CLASS_CONTEXT_SPECIFIC) {  in x509_parse_tbs_certificate()
1592 			asn1_unexpected(&hdr,  in x509_parse_tbs_certificate()
1598 	if (hdr.tag == 2) {  in x509_parse_tbs_certificate()
1603 		pos = hdr.payload + hdr.length;  in x509_parse_tbs_certificate()
1607 		if (asn1_get_next(pos, end - pos, &hdr) < 0 ||  in x509_parse_tbs_certificate()
1608 		    hdr.class != ASN1_CLASS_CONTEXT_SPECIFIC) {  in x509_parse_tbs_certificate()
1609 			asn1_unexpected(&hdr,  in x509_parse_tbs_certificate()
1615 	if (hdr.tag != 3) {  in x509_parse_tbs_certificate()
1618 			   hdr.constructed, hdr.tag);  in x509_parse_tbs_certificate()
1631 	if (x509_parse_extensions(cert, hdr.payload, hdr.length) < 0)  in x509_parse_tbs_certificate()
1634 	pos = hdr.payload + hdr.length;  in x509_parse_tbs_certificate()
1729 	struct asn1_hdr hdr;  in x509_certificate_parse()  local
1746 	if (asn1_get_next(pos, len, &hdr) < 0 || !asn1_is_sequence(&hdr)) {  in x509_certificate_parse()
1747 		asn1_unexpected(&hdr,  in x509_certificate_parse()
1752 	pos = hdr.payload;  in x509_certificate_parse()
1754 	if (hdr.length > end - pos) {  in x509_certificate_parse()
1759 	if (hdr.length < end - pos) {  in x509_certificate_parse()
1762 			    pos + hdr.length, end - (pos + hdr.length));  in x509_certificate_parse()
1763 		end = pos + hdr.length;  in x509_certificate_parse()
1782 	if (asn1_get_next(pos, end - pos, &hdr) < 0 ||  in x509_certificate_parse()
1783 	    !asn1_is_bitstring(&hdr)) {  in x509_certificate_parse()
1784 		asn1_unexpected(&hdr,  in x509_certificate_parse()
1789 	if (hdr.length < 1) {  in x509_certificate_parse()
1793 	pos = hdr.payload;  in x509_certificate_parse()
1806 	cert->sign_value = os_memdup(pos + 1, hdr.length - 1);  in x509_certificate_parse()
1813 	cert->sign_value_len = hdr.length - 1;  in x509_certificate_parse()
1846 	struct asn1_hdr hdr;  in x509_check_signature()  local
1898 	if (asn1_get_next(data, data_len, &hdr) < 0 ||  in x509_check_signature()
1899 	    !asn1_is_sequence(&hdr)) {  in x509_check_signature()
1900 		asn1_unexpected(&hdr, "X509: Expected SEQUENCE (DigestInfo)");  in x509_check_signature()
1904 	wpa_hexdump(MSG_MSGDUMP, "X509: DigestInfo", hdr.payload, hdr.length);  in x509_check_signature()
1906 	pos = hdr.payload;  in x509_check_signature()
1907 	end = pos + hdr.length;  in x509_check_signature()
1917 	if (asn1_get_next(pos, end - pos, &hdr) < 0 ||  in x509_check_signature()
1918 	    !asn1_is_sequence(&hdr)) {  in x509_check_signature()
1919 		asn1_unexpected(&hdr,  in x509_check_signature()
1925 		    hdr.payload, hdr.length);  in x509_check_signature()
1926 	da_end = hdr.payload + hdr.length;  in x509_check_signature()
1928 	if (asn1_get_oid(hdr.payload, hdr.length, &oid, &next)) {  in x509_check_signature()
1942 	    (asn1_get_next(next, da_end - next, &hdr) < 0 ||  in x509_check_signature()
1943 	     !asn1_is_null(&hdr) ||  in x509_check_signature()
1944 	     hdr.payload + hdr.length != da_end)) {  in x509_check_signature()
2029 	if (asn1_get_next(pos, end - pos, &hdr) < 0 ||  in x509_check_signature()
2030 	    !asn1_is_octetstring(&hdr)) {  in x509_check_signature()
2031 		asn1_unexpected(&hdr, "X509: Expected OCTETSTRING (Digest)");  in x509_check_signature()
2036 		    hdr.payload, hdr.length);  in x509_check_signature()
2077 	if (hdr.length != hash_len ||  in x509_check_signature()
2078 	    os_memcmp_const(hdr.payload, hash, hdr.length) != 0) {  in x509_check_signature()
2085 	if (hdr.payload + hdr.length < data + data_len) {  in x509_check_signature()
2088 			    hdr.payload + hdr.length,  in x509_check_signature()
2089 			    data + data_len - hdr.payload - hdr.length);  in x509_check_signature()