On 16/04/2024 12:19, Martin Man via mbed-tls wrote:
I assume the argument to not touch the `next` pointer comes from the fact that you need to properly free any memory, or keep a reference to it when breaking the chain.
That's right. Reading from the next pointer is not a problem. But if you modify it, you need to be compatible with the library's memory management, and that's risky. If you aren't careful, you might have a memory leak, or worse, a use-after-free.

Appending a certificate to one existing chain is fine. On the other hand, appending the same certificate to multiple chains is dangerous: if you then call mbedtls_x509_crt_free() on one chain, it will cause the other chain to have a dangling pointer.


On 16/04/2024 10:37, Roman Janota via mbed-tls wrote:
Is there a way to treat mbedtls_x509_crt simply as a certificate store? Say I have some PEM data, parse it into a temporary mbedtls_x509_crt and then I would like to append this certificate to said mbedtls_x509_crt certificate store.
Due to the difficulty of ensuring correct memory management in C, the official way to do this is to parse the certificate directly into the chain: mbedtls_x509_crt_parse() and friends do this, and doing it that way ensures that a certificate only ends up on one chain.

Best regards,

--
Gilles Peskine
Mbed TLS developer