Mac: Look for issuer in a certificate chain instead of subject

net/base/x509_certificate_mac.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/x509_certificate.h"
 
 #include <CommonCrypto/CommonDigest.h>
 #include <Security/Security.h>
 #include <time.h>
 
@@ skipping 843 matching lines @@
   // Check all the certs in the chain for a match.
   int n = CFArrayGetCount(cert_chain);
   for (int i = 0; i < n; ++i) {
     SecCertificateRef cert_handle = reinterpret_cast<SecCertificateRef>(
         const_cast<void*>(CFArrayGetValueAtIndex(cert_chain, i)));
     scoped_refptr<X509Certificate> cert = X509Certificate::CreateFromHandle(
         cert_handle,
         X509Certificate::SOURCE_LONE_CERT_IMPORT,
         X509Certificate::OSCertHandles());
     for (unsigned j = 0; j < valid_issuers.size(); j++) {
-      if (cert->subject().Matches(valid_issuers[j]))
+      if (cert->issuer().Matches(valid_issuers[j]))

[wtc, 2010/08/03 03:25:54]

No wonder this bug looks familiar to me.

I noted this bug when I reviewed this code before.
See my last comment in
http://codereview.chromium.org/1128008

         return true;
     }
   }
   return false;
 }
 
 // static
 OSStatus X509Certificate::CreateSSLClientPolicy(SecPolicyRef* out_policy) {
   CSSM_APPLE_TP_SSL_OPTIONS tp_ssl_options = {
     CSSM_APPLE_TP_SSL_OPTS_VERSION,
@@ skipping 112 matching lines @@
     }
     CFRelease(cert_chain);
   }
 exit:
   if (result)
     LOG(ERROR) << "CreateIdentityCertificateChain error " << result;
   return chain.release();
 }
 
 }  // namespace net