> This is the needed patch:
This patch should not work either, you still need a skip_tag before the
> - tag = ber_skip_tag( ber,&len ); /* Context +
> (version) */
> + tag = ber_peek_tag( ber,&len ); /* Context +
I confirm this patch worked for me, at least it did on an amd64 I'm working
It worked both with openssl-generated v1 (no version tag present) and v3
certificates (version tag present).
I don't know if this is an cpu-architecture -dependent issue (I don't think
so), nor I know how the ber_* library works, but FWICU the Context +
Constructed stuff is handled as a tag prefix by the ber_get_int(), which
then discards it when found and fetches the encapsulated value.
Instead, ber_peek_tag() is probably more simple-minded in that it peeks the
first word at the buffer pointer, which is the Context + Constructed prefix,
not really the tag.
I can of course be wrong, but with this patch I got i==2 from v3
certificates, which is the correct value.