getTBSCertificate is broken about bitcore-payment-protocol HOT 2 CLOSED

Actually, it is still possible to get away with quick-and-dirty parsing if you do
getTBSCertificate(data, c.signature.data.length);
and then search the tail starting with
data.length - 1 - siglen

from bitcore-payment-protocol.

I'm afraid there is no way around proper asn1 parsing.

Trust me, I know that much. I spent a long time tearing my damn hair out over asn.1/x.509.

asn1.js was originally going to be used for this, but it was impossible to grab the raw TBS cert out of a signed cert with asn1.js. I was thinking about ripping out of a bunch of code from the asn1.js parser just to get TBS certs, but I tried a simpler solution instead, which worked in practice.

You're right I did overlook the possibility of the sig containing a nul byte. Passing in the sig length we get from the asn1.js output is probably the easiest way to fix this. (If we wanted to make this function even cleaner, and to avoid an extra parameter, we could even just have asn1.js parse the cert data itself within getTBSCertificate to get the sig length. But of course, that adds unnecessary overhead.)

from bitcore-payment-protocol.