Make X509Certificate::CreateFromHandle() copy the OSCertHandle, rather than assume ownership

net/socket/ssl_client_socket_nss.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This file includes code SSLClientSocketNSS::DoVerifyCertComplete() derived
 // from AuthCertificateCallback() in
 // mozilla/security/manager/ssl/src/nsNSSCallbacks.cpp.
 
 /* ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
@@ skipping 705 matching lines @@
         CERT_DestroyCertList(cert_list);
       }
 
       // Finally create the X509Certificate object.
       cert_handle = CreateOSCert(server_cert_nss_->derCert);
       DCHECK(cert_handle);
       server_cert_ = X509Certificate::CreateFromHandle(
           cert_handle,
           X509Certificate::SOURCE_FROM_NETWORK,
           intermediate_ca_certs);
+      X509Certificate::FreeOSCertHandle(cert_handle);
       for (size_t i = 0; i < intermediate_ca_certs.size(); ++i)
         X509Certificate::FreeOSCertHandle(intermediate_ca_certs[i]);
 #else
       server_cert_ = X509Certificate::CreateFromHandle(
-          CERT_DupCertificate(server_cert_nss_),
+          server_cert_nss_,
           X509Certificate::SOURCE_FROM_NETWORK,
           X509Certificate::OSCertHandles());
 #endif
     }
   }
   return server_cert_;
 }
 
 // Log an informational message if the server does not support secure
 // renegotiation (RFC 5746).
@@ skipping 509 matching lines @@
     PCCERT_CONTEXT cert_context2;
     BOOL ok = CertAddCertificateContextToStore(cert_store_, cert_context,
                                                CERT_STORE_ADD_USE_EXISTING,
                                                &cert_context2);
     if (!ok) {
       NOTREACHED();
       continue;
     }
     scoped_refptr<X509Certificate> cert = X509Certificate::CreateFromHandle(
         cert_context2, X509Certificate::SOURCE_LONE_CERT_IMPORT,
-        net::X509Certificate::OSCertHandles());
+        X509Certificate::OSCertHandles());
+    X509Certificate::FreeOSCertHandle(cert_context2);
     that->client_certs_.push_back(cert);
   }
 
   BOOL ok = CertCloseStore(my_cert_store, CERT_CLOSE_STORE_CHECK_FLAG);
   DCHECK(ok);
 
   // Tell NSS to suspend the client authentication.  We will then abort the
   // handshake by returning ERR_SSL_CLIENT_AUTH_CERT_NEEDED.
   return SECWouldBlock;
 #elif defined(OS_MACOSX)
@@ skipping 64 matching lines @@
       // Only check unexpired certs.
       if (CERT_CheckCertValidTimes(cert, PR_Now(), PR_TRUE) ==
           secCertTimeValid && (!ca_names->nnames ||
           NSS_CmpCertChainWCANames(cert, ca_names) == SECSuccess)) {
         privkey = PK11_FindKeyByAnyCert(cert, wincx);
         if (privkey) {
           X509Certificate* x509_cert = X509Certificate::CreateFromHandle(
               cert, X509Certificate::SOURCE_LONE_CERT_IMPORT,
               net::X509Certificate::OSCertHandles());
           that->client_certs_.push_back(x509_cert);
+          CERT_DestroyCertificate(cert);
           SECKEY_DestroyPrivateKey(privkey);
           continue;
         }
       }
       CERT_DestroyCertificate(cert);
     }
     CERT_FreeNicknames(names);
   }
 
   // Tell NSS to suspend the client authentication.  We will then abort the
@@ skipping 187 matching lines @@
   PRErrorCode prerr = PR_GetError();
   if (prerr == PR_WOULD_BLOCK_ERROR) {
     LeaveFunction("");
     return ERR_IO_PENDING;
   }
   LeaveFunction("");
   return MapNSPRError(prerr);
 }
 
 }  // namespace net