Define X509Certificate::intermediate_ca_certs_ as a std::vector of...

net/socket/ssl_client_socket_mac.cc

 // Copyright (c) 2008-2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/socket/ssl_client_socket_mac.h"
 
 #include "base/scoped_cftyperef.h"
 #include "base/singleton.h"
 #include "base/string_util.h"
 #include "net/base/cert_verifier.h"
@@ skipping 268 matching lines @@
       const_cast<void*>(CFArrayGetValueAtIndex(certs, 0)));
   CFRetain(server_cert);
   X509Certificate *x509_cert = X509Certificate::CreateFromHandle(
       server_cert, X509Certificate::SOURCE_FROM_NETWORK);
   if (!x509_cert)
     return NULL;
 
   // Add each of the intermediate certificates in the server's chain to the
   // server's X509Certificate object. This makes them available to
   // X509Certificate::Verify() for chain building.
+  // TODO(wtc): Since X509Certificate::CreateFromHandle may return a cached
+  // X509Certificate object, we may be adding intermediate CA certificates to
+  // it repeatedly!
   CFIndex certs_length = CFArrayGetCount(certs);
   for (CFIndex i = 1; i < certs_length; ++i) {
     SecCertificateRef cert_ref = reinterpret_cast<SecCertificateRef>(
         const_cast<void*>(CFArrayGetValueAtIndex(certs, i)));
+    CFRetain(cert_ref);
     x509_cert->AddIntermediateCertificate(cert_ref);
   }
 
   return x509_cert;
 }
 
 }  // namespace
 
 //-----------------------------------------------------------------------------
 
@@ skipping 538 matching lines @@
   if (total_read) {
     memcpy(data, &us->recv_buffer_[0], total_read);
     us->recv_buffer_.clear();
   }
 
   if (rv != ERR_IO_PENDING)
     us->read_io_buf_ = NULL;
 
   if (rv < 0)
     return OSStatusFromNetError(rv);
-  else if (rv == 0) // stream closed
+  else if (rv == 0)  // stream closed
     return errSSLClosedGraceful;
   else
     return noErr;
 }
 
 // static
 OSStatus SSLClientSocketMac::SSLWriteCallback(SSLConnectionRef connection,
                                               const void* data,
                                               size_t* data_length) {
   SSLClientSocketMac* us =
@@ skipping 37 matching lines @@
   if (rv < 0 && rv != ERR_IO_PENDING) {
     us->write_io_buf_ = NULL;
     return OSStatusFromNetError(rv);
   }
 
   // always lie to our caller
   return noErr;
 }
 
 }  // namespace net