If the version field is omitted from the certificate, the default

chrome/common/net/x509_certificate_model_nss.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/common/net/x509_certificate_model.h"
 
 #include <cert.h>
 #include <cms.h>
 #include <hasht.h>
 #include <keyhi.h>  // SECKEY_DestroyPrivateKey
@@ skipping 107 matching lines @@
       name = name.substr(colon_pos + 1);
   }
   return name;
 }
 
 string GetTokenName(X509Certificate::OSCertHandle cert_handle) {
   return psm::GetCertTokenName(cert_handle);
 }
 
 string GetVersion(X509Certificate::OSCertHandle cert_handle) {
-  unsigned long version = ULONG_MAX;
-  if (SEC_ASN1DecodeInteger(&cert_handle->version, &version) == SECSuccess &&
-      version != ULONG_MAX)

[wtc, 2012/05/18 01:15:57]

I guess the version != ULONG_MAX check here is to work
around a bug in SEC_ASN1DecodeInteger when
    cert_handle->version.data != NULL
    cert_handle->version,len == 0

In that case, SEC_ASN1DecodeInteger returns SECSuccess
and stores either 0 or (unsigned long)-1 in the output
argument.

In the new code, we don't call SEC_ASN1DecodeInteger
if cert_handle->version.len == 0, so this workaround is
not necessary.

[mattm, 2012/05/18 03:19:50]

Honestly I can't remember why it's that way, but that sounds likely.
sounds good.  Do we need to check version.data == NULL also or will len always
be 0 in that case?

[wtc, 2012/05/18 21:47:13]

In my testing with several recent versions of NSS, I always
see data == NULL, len == 0.  So it should be sufficient to
just check version.len == 0.

+  // If the version field is omitted from the certificate, the default
+  // value is v1(0).
+  unsigned long version = 0;
+  if (cert_handle->version.len == 0 ||
+      SEC_ASN1DecodeInteger(&cert_handle->version, &version) == SECSuccess) {
     return base::UintToString(version + 1);
+  }
   return "";
 }
 
 net::CertType GetType(X509Certificate::OSCertHandle cert_handle) {
     return psm::GetCertType(cert_handle);
 }
 
 string GetEmailAddress(X509Certificate::OSCertHandle cert_handle) {
   if (cert_handle->emailAddr)
     return cert_handle->emailAddr;
@@ skipping 262 matching lines @@
 string ProcessRawBitsSignatureWrap(X509Certificate::OSCertHandle cert_handle) {
   return ProcessRawBits(cert_handle->signatureWrap.signature.data,
                         cert_handle->signatureWrap.signature.len);
 }
 
 void RegisterDynamicOids() {
   psm::RegisterDynamicOids();
 }
 
 }  // namespace x509_certificate_model