SEQUENCE OF/SET OF generate infinite loop in constraint check (again!)

[robstradling]

It looks like 14e75ed caused a regression w.r.t. dfc9314.

I'm seeing exactly the same behaviour (infinite loop) as described in #195 when trying to check the constraints for a PKIX SubjectAltName.

[mouse07410]

@robstradling could you please provide a simple/small reproducer?

[robstradling]

@mouse07410 Please take a look at https://github.com/certlint/certlint. It's an X.509 certificate linter written in Ruby, which incorporates a C library (asn1validator.so) that's largely autogenerated by asn1c. https://github.com/certlint/certlint/tree/master/ext/README provides instructions (including applying the patch from this PR) for building asn1validator.so.
Without the patch from this PR, certlint hangs whenever it attempts to process a certificate that contains a Subject Alternative Name extension (see https://tools.ietf.org/html/rfc5280#section-4.2.1.6). With the patch from this PR applied, it doesn't hang.

[mouse07410]

Oh, so the asn1c code is used in a package that makes this behavior manifested.

I was thinking of a small C program (ideally, less than 100 lines of code) with a set of ASN.1 files (presumably from PKIX) that would demonstrate this hangup.

Building and debugging a Ruby app sounds less enticing... :-(

And in its current form, I can't even apply this patch, because it breaks the existing CI.

[vlm]

Patch accepted, thank you!

[robstradling]

Thanks @vlm !