code review 4657080: crypto/x509: prevent chain cycles in Verify

src/pkg/crypto/x509/verify.go

 // Copyright 2011 The Go Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
 package x509
 
 import (
         "os"
         "strings"
         "time"
@@ skipping 153 matching lines @@
 func (c *Certificate) buildChains(cache map[int][][]*Certificate, currentChain []*Certificate, opts *VerifyOptions) (chains [][]*Certificate, err os.Error) {
         for _, rootNum := range opts.Roots.findVerifiedParents(c) {
                 root := opts.Roots.certs[rootNum]
                 err = root.isValid(rootCertificate, opts)
                 if err != nil {
                         continue
                 }
                 chains = append(chains, appendToFreshChain(currentChain, root))
         }
 
+nextIntermediate:
         for _, intermediateNum := range opts.Intermediates.findVerifiedParents(c) {
                 intermediate := opts.Intermediates.certs[intermediateNum]
+                for _, cert := range currentChain {
+                        if cert == intermediate {
+                                continue nextIntermediate
+                        }
+                }
                 err = intermediate.isValid(intermediateCertificate, opts)
                 if err != nil {
                         continue
                 }
                 var childChains [][]*Certificate
                 childChains, ok := cache[intermediateNum]
                 if !ok {
                         childChains, err = intermediate.buildChains(cache, appendToFreshChain(currentChain, intermediate), opts)
                         cache[intermediateNum] = childChains
                 }
@@ skipping 44 matching lines @@
                                 return nil
                         }
                 }
                 // If Subject Alt Name is given, we ignore the common name.
         } else if matchHostnames(c.Subject.CommonName, h) {
                 return nil
         }
 
         return HostnameError{c, h}
 }