crypto/x509: ParseCertificate should mention the ownership of the slice passed to it.

[mateusz834]

ParseCertificate and ParseCertificates should mention that the argument (der) is the same as the cert.Raw.

go/src/crypto/x509/parser.go

Lines 800 to 810 in 267b50a

	func parseCertificate(der []byte) (*Certificate, error) {
	cert := &Certificate{}
	input := cryptobyte.String(der)
	// we read the SEQUENCE including length and tag bytes so that
	// we can populate Certificate.Raw, before unwrapping the
	// SEQUENCE so it can be operated on
	if !input.ReadASN1Element(&input, cryptobyte_asn1.SEQUENCE) {
	return nil, errors.New("x509: malformed certificate")
	}
	cert.Raw = input

From the docs is doesn't seem to be the case.

go/src/crypto/x509/parser.go

Lines 983 to 985 in 267b50a

	// ParseCertificate parses a single certificate from the given ASN.1 DER data.
	func ParseCertificate(der []byte) (*Certificate, error) {
	cert, err := parseCertificate(der)

All of these fields should mention that they share the memory with the slice passed to ParseCertificate.

go/src/crypto/x509/x509.go

Lines 677 to 684 in 267b50a

	type Certificate struct {
	Raw []byte // Complete ASN.1 DER content (certificate, signature algorithm and signature).
	RawTBSCertificate []byte // Certificate part of raw ASN.1 DER content.
	RawSubjectPublicKeyInfo []byte // DER encoded SubjectPublicKeyInfo.
	RawSubject []byte // DER encoded Subject
	RawIssuer []byte // DER encoded Issuer
	Signature []byte

[seankhliao]

cc @golang/security

[gopherbot]

Change https://go.dev/cl/496143 mentions this issue: crypto/x509: mention arg ownership of ParseCertificate(Request)