+
+ const CE_BasicConstraints *bcp =
+ &thisCertInfo->basicConstraints.extnData->basicConstraints;
+
+ cA = bcp->cA;
+
+ /* Verify pathLenConstraint if present */
+ if(!isLeaf && // leaf, certDex=0, don't care
+ cA && // p.l.c. only valid for CAs
+ bcp->pathLenConstraintPresent) { // present?
+ /*
+ * pathLenConstraint=0 legal for certDex 1 only
+ * pathLenConstraint=1 legal for certDex {1,2}
+ * etc.
+ */
+ if(certDex > (bcp->pathLenConstraint + 1)) {
+ errorLog0("tp_policyVerify: pathLenConstraint exceeded\n");
+ policyFail = CSSM_TRUE;
+ thisTpCertInfo->addStatusCode(
+ CSSMERR_APPLETP_PATH_LEN_CONSTRAINT);
+ }
+ }