diff -r 000000000000 -r 6474c204b198 security/pkix/lib/pkixder.cpp
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/security/pkix/lib/pkixder.cpp	Wed Dec 31 06:09:35 2014 +0100
@@ -0,0 +1,82 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* Copyright 2013 Mozilla Foundation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "pkixder.h"
+
+namespace mozilla { namespace pkix { namespace der {
+
+// not inline
+Result
+Fail(PRErrorCode errorCode)
+{
+  PR_SetError(errorCode, 0);
+  return Failure;
+}
+
+// Too complicated to be inline
+Result
+ExpectTagAndGetLength(Input& input, uint8_t expectedTag, uint16_t& length)
+{
+  PR_ASSERT((expectedTag & 0x1F) != 0x1F); // high tag number form not allowed
+
+  uint8_t tag;
+  if (input.Read(tag) != Success) {
+    return Failure;
+  }
+
+  if (tag != expectedTag) {
+    return Fail(SEC_ERROR_BAD_DER);
+  }
+
+  // The short form of length is a single byte with the high order bit set
+  // to zero. The long form of length is one byte with the high order bit
+  // set, followed by N bytes, where N is encoded in the lowest 7 bits of
+  // the first byte.
+  uint8_t length1;
+  if (input.Read(length1) != Success) {
+    return Failure;
+  }
+  if (!(length1 & 0x80)) {
+    length = length1;
+  } else if (length1 == 0x81) {
+    uint8_t length2;
+    if (input.Read(length2) != Success) {
+      return Failure;
+    }
+    if (length2 < 128) {
+      // Not shortest possible encoding
+      return Fail(SEC_ERROR_BAD_DER);
+    }
+    length = length2;
+  } else if (length1 == 0x82) {
+    if (input.Read(length) != Success) {
+      return Failure;
+    }
+    if (length < 256) {
+      // Not shortest possible encoding
+      return Fail(SEC_ERROR_BAD_DER);
+    }
+  } else {
+    // We don't support lengths larger than 2^16 - 1.
+    return Fail(SEC_ERROR_BAD_DER);
+  }
+
+  // Ensure the input is long enough for the length it says it has.
+  return input.EnsureLength(length);
+}
+
+} } } // namespace mozilla::pkix::der