Make X509Certificate::CreateFromHandle() copy the OSCertHandle, rather than assume ownership

net/base/cert_test_util.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/cert_test_util.h"
 
 #include "build/build_config.h"
 
 #if defined(USE_NSS)
 #include <cert.h>
@@ skipping 37 matching lines @@
     return NULL;
   }
 
   rv = CERT_ChangeCertTrust(CERT_GetDefaultCertDB(), cert, &trust);
   if (rv != SECSuccess) {
     LOG(ERROR) << "Can't change trust for certificate " << filename.value();
     CERT_DestroyCertificate(cert);
     return NULL;
   }
 
-  return X509Certificate::CreateFromHandle(cert,
+  X509Certificate* result = X509Certificate::CreateFromHandle(
+      cert,
       X509Certificate::SOURCE_LONE_CERT_IMPORT,
       X509Certificate::OSCertHandles());
+  CERT_DestroyCertificate(cert);
+  return result;
 }
 #endif
 
 #if defined(OS_MACOSX)
 X509Certificate* LoadTemporaryRootCert(const FilePath& filename) {
   std::string rawcert;
   if (!file_util::ReadFileToString(filename, &rawcert)) {
     LOG(ERROR) << "Can't load certificate " << filename.value();
     return NULL;
   }
@@ skipping 11 matching lines @@
   if (SecKeychainItemImport(pem, NULL, &input_format, &item_type, 0, NULL, NULL,
                             &cert_array))
     return NULL;
   scoped_cftyperef<CFArrayRef> scoped_cert_array(cert_array);
 
   if (!CFArrayGetCount(cert_array))
     return NULL;
 
   SecCertificateRef cert_ref = static_cast<SecCertificateRef>(
       const_cast<void*>(CFArrayGetValueAtIndex(cert_array, 0)));
-  CFRetain(cert_ref);
+
   return X509Certificate::CreateFromHandle(cert_ref,
       X509Certificate::SOURCE_LONE_CERT_IMPORT,
       X509Certificate::OSCertHandles());
 }
 #endif
 
 }  // namespace net