Make X509Certificate::CreateFromHandle() copy the OSCertHandle, rather than assume ownership

net/socket/ssl_client_socket_mac.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/socket/ssl_client_socket_mac.h"
 
 #include <CoreServices/CoreServices.h>
 #include <netdb.h>
 #include <sys/socket.h>
 #include <sys/types.h>
@@ skipping 414 matching lines @@
   std::vector<SecCertificateRef> intermediate_ca_certs;
   CFIndex certs_length = CFArrayGetCount(certs);
   for (CFIndex i = 1; i < certs_length; ++i) {
     SecCertificateRef cert_ref = reinterpret_cast<SecCertificateRef>(
         const_cast<void*>(CFArrayGetValueAtIndex(certs, i)));
     intermediate_ca_certs.push_back(cert_ref);
   }
 
   SecCertificateRef server_cert = static_cast<SecCertificateRef>(
       const_cast<void*>(CFArrayGetValueAtIndex(certs, 0)));
-  CFRetain(server_cert);
   return X509Certificate::CreateFromHandle(
       server_cert, X509Certificate::SOURCE_FROM_NETWORK, intermediate_ca_certs);
 }
 
 // Dynamically look up a pointer to a function exported by a bundle.
 template <typename FNTYPE>
 FNTYPE LookupFunction(CFStringRef bundleName, CFStringRef fnName) {
   CFBundleRef bundle = CFBundleGetBundleWithIdentifier(bundleName);
   if (!bundle)
     return NULL;
@@ skipping 847 matching lines @@
   if (rv < 0 && rv != ERR_IO_PENDING) {
     us->write_io_buf_ = NULL;
     return OSStatusFromNetError(rv);
   }
 
   // always lie to our caller
   return noErr;
 }
 
 }  // namespace net