Make X509Certificate::CreateFromHandle() copy the OSCertHandle, rather than assume ownership

net/base/x509_certificate.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/x509_certificate.h"
 
 #if defined(OS_MACOSX)
 #include <Security/Security.h>
 #elif defined(USE_NSS)
 #include <cert.h>
@@ skipping 123 matching lines @@
   // Check if we already have this certificate in memory.
   X509Certificate::Cache* cache = X509Certificate::Cache::GetInstance();
   X509Certificate* cached_cert =
       cache->Find(CalculateFingerprint(cert_handle));
   if (cached_cert) {
     DCHECK(cached_cert->source_ != SOURCE_UNUSED);
     if (cached_cert->source_ > source ||
         (cached_cert->source_ == source &&
          cached_cert->HasIntermediateCertificates(intermediates))) {
       // Return the certificate with the same fingerprint from our cache.
-      // But we own the input OSCertHandle, which makes it our job to free it.
-      FreeOSCertHandle(cert_handle);
       DHISTOGRAM_COUNTS("X509CertificateReuseCount", 1);
       return cached_cert;
     }
     // Else the new cert is better and will replace the old one in the cache.
   }
 
   // Otherwise, allocate and cache a new object.
   X509Certificate* cert = new X509Certificate(cert_handle, source,
                                               intermediates);
   cache->Insert(cert);
   return cert;
 }
 
 // static
 X509Certificate* X509Certificate::CreateFromBytes(const char* data,
                                                   int length) {
   OSCertHandle cert_handle = CreateOSCertHandleFromBytes(data, length);
   if (!cert_handle)
     return NULL;
 
-  return CreateFromHandle(cert_handle,
-                          SOURCE_LONE_CERT_IMPORT,
-                          OSCertHandles());
+  X509Certificate* cert = CreateFromHandle(cert_handle,
+                                           SOURCE_LONE_CERT_IMPORT,
+                                           OSCertHandles());
+  FreeOSCertHandle(cert_handle);
+  return cert;
 }
 
 X509Certificate::X509Certificate(OSCertHandle cert_handle,
                                  Source source,
                                  const OSCertHandles& intermediates)
-    : cert_handle_(cert_handle),
+    : cert_handle_(DupOSCertHandle(cert_handle)),
       source_(source) {
 #if defined(OS_MACOSX) || defined(OS_WIN)
   // Copy/retain the intermediate cert handles.
   for (size_t i = 0; i < intermediates.size(); ++i)
     intermediate_ca_certs_.push_back(DupOSCertHandle(intermediates[i]));
 #endif
   // Platform-specific initialization.
   Initialize();
 }
 
@@ skipping 39 matching lines @@
 
 bool X509Certificate::HasIntermediateCertificates(const OSCertHandles& certs) {
   for (size_t i = 0; i < certs.size(); ++i) {
     if (!HasIntermediateCertificate(certs[i]))
       return false;
   }
   return true;
 }
 
 }  // namespace net