Re: [xml] validating xmld:dsig schema with a large size serial number

On Sun, Mar 09, 2008 at 10:47:43AM +0100, Jean-Marc Desperrier wrote:

I found a limitation in libxml2 schema validation that is really 
annoying in the context of xml:dsig.
(after writing the first version of this bug, I found out it's already 
reported in bug 350248)
The xs:integer type is limited to handling at most 24 digit integers.
The trouble is that that the X509SerialNumber field in the xml dsig 
schema uses that type ( ), and x509 
certificate serial number can have a size of up to 20 byte (in 
2-complement binary representation).

A generic solution to handle integers of any size would probably be 
hard, but would it be possible to have a work around just for that case 
? Currently, libxml2 hard codes the the size limit to 24 digits because 
it then stores the value in 3 long integer variables. Using 5 variables 
might be enough to handle the values X509SerialNumber will take.

What would be the consequences of removing the test for the 24 digits on 
a local instance of libxml2 ? Just making facets applied to integer 
larger than the limit buggy ?

  the problem is then we would have no way to store the value. I think
having a disconnection between what we accept in the representation and what
we handle in the type system, would be very confusing in general.

I see Daniel complains in the bug that using integer for this field is 
just a bad choice, but the trouble is that it's in the xml:dsig norm, 
that has been accepted as a W3C Recommendation.
I approve it's been badly conceived, another point that shows that is 
that almost all X509 experts don't understand why that field uses 
decimal, and think it should be using hexadecimal instead.

  If you provide a patch to grow to 5 long and it doesn't look silly
I may apply it to avoid the problem, but really this is a bad case of
misuse affecting implementation.


Red Hat Virtualization group
Daniel Veillard      | virtualization library
veillard redhat com  | libxml GNOME XML XSLT toolkit | Rpmfind RPM search engine

[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]