Return the constructed certificate chain in X509Certificate::Verify()

net/base/x509_certificate.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/x509_certificate.h"
 
 #include <stdlib.h>
 
 #include <algorithm>
 #include <map>
@@ skipping 574 matching lines @@
     if (reference_host.starts_with(pattern_begin) &&
         reference_host.ends_with(pattern_end))
       return true;
   }
   return false;
 }
 
 int X509Certificate::Verify(const std::string& hostname, int flags,
                             CertVerifyResult* verify_result) const {
   verify_result->Reset();
+  verify_result->verified_cert =
+      CreateFromHandle(cert_handle_, intermediate_ca_certs_);

[wtc, 2011/07/26 19:32:29]

Since X509Certificate is reference-counted, I think you
can just say
  verify_result->verified_cert = this;

It doesn't seem necessary to construct a copy of the
current X509Certificate object.

[Ryan Sleevi, 2011/07/26 23:28:31]

This came up on discussion on IRC yesterday, as I was exploring doing this.
Though RefCountedThreadSafe::AddRef() and Release() are const, because this is
in a const method, I have a (const X509Certificate*) |this|.

Obviously, I can get away with it by doing const_cast<X509Certificate*>(this),
but that seemed a violation of the API, particularly with where sergeyu was
heading towards refactoring.

That said, because all of X509Certificate is initialized at ctor and there are
no non-const methods, I've added the const_cast<>, as this will save some small
amount of memory in the returned chain on error.

 
   if (IsBlacklisted()) {
     verify_result->cert_status |= CERT_STATUS_REVOKED;
     return ERR_CERT_REVOKED;
   }
 
   int rv = VerifyInternal(hostname, flags, verify_result);
 
   // If needed, do any post-validation here.
   return rv;
@@ skipping 96 matching lines @@
 bool X509Certificate::IsSHA1HashInSortedArray(const SHA1Fingerprint& hash,
                                               const uint8* array,
                                               size_t array_byte_len) {
   DCHECK_EQ(0u, array_byte_len % base::SHA1_LENGTH);
   const unsigned arraylen = array_byte_len / base::SHA1_LENGTH;
   return NULL != bsearch(hash.data, array, arraylen, base::SHA1_LENGTH,
                          CompareSHA1Hashes);
 }
 
 }  // namespace net