Ensure X509Certificate::OSCertHandles are safe to be used on both UI and IO threads on Win

net/base/x509_certificate_openssl.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/x509_certificate.h"
 
 #include <openssl/asn1.h>
 #include <openssl/crypto.h>
 #include <openssl/obj_mac.h>
 #include <openssl/pem.h>
@@ skipping 289 matching lines @@
 }
 
 // static
 void X509Certificate::FreeOSCertHandle(OSCertHandle cert_handle) {
   // Decrement the ref-count for the cert and, if all references are gone,
   // free the memory and any application-specific data associated with the
   // certificate.
   X509_free(cert_handle);
 }
 
+// static
+void X509Certificate::FreeOSCertListHandle(OSCertListHandle cert_list) {

[wtc, 2011/10/04 00:26:34]

cert_list => cert_list_handle

+  sk_X509_pop_free(cert_list, X509_free);
+}
+
 void X509Certificate::Initialize() {
   crypto::EnsureOpenSSLInit();
   fingerprint_ = CalculateFingerprint(cert_handle_);
 
   ASN1_INTEGER* num = X509_get_serialNumber(cert_handle_);
   if (num) {
     serial_number_ = std::string(
         reinterpret_cast<char*>(num->data),
         num->length);
     // Remove leading zeros.
@@ skipping 15 matching lines @@
 SHA1Fingerprint X509Certificate::CalculateFingerprint(OSCertHandle cert) {
   SHA1Fingerprint sha1;
   unsigned int sha1_size = static_cast<unsigned int>(sizeof(sha1.data));
   int ret = X509_digest(cert, EVP_sha1(), sha1.data, &sha1_size);
   CHECK(ret);
   CHECK_EQ(sha1_size, sizeof(sha1.data));
   return sha1;
 }
 
 // static
+X509Certificate::OSCertListHandle
+X509Certificate::CreateOSCertListHandle() const {

[wtc, 2011/10/04 00:26:34]

Change VerifyInternal to use CreateOSCertListHandle().

+  STACK_OF(X509)* cert_list_handle = sk_X509_new_null();
+  if (!cert_list_handle)
+    return NULL;
+
+  if (!sk_X509_push(cert_list_handle, DupOSCertHandle(cert_handle_))) {
+    FreeOSCertListHandle(cert_list_handle);
+    return NULL;
+  }
+
+  bool ok = true;
+  for (size_t i = 0; i < intermediate_ca_certs_.size(); ++i) {
+    if (!sk_X509_push(cert_list_handle,
+                      DupOSCertHandle(intermediate_ca_certs_[i]))) {
+      ok = false;
+      break;
+    }
+  }
+  if (!ok) {
+    FreeOSCertListHandle(cert_list_handle);
+    return NULL;
+  }
+
+  return cert_list_handle;
+}
+
+// static
 X509Certificate::OSCertHandle X509Certificate::CreateOSCertHandleFromBytes(
     const char* data, int length) {
   if (length < 0)
     return NULL;
   crypto::EnsureOpenSSLInit();
   const unsigned char* d2i_data =
       reinterpret_cast<const unsigned char*>(data);
   // Don't cache this data via SetDERCache as this wire format may be not be
   // identical from the i2d_X509 roundtrip.
   X509* cert = d2i_X509(NULL, &d2i_data, length);
@@ skipping 167 matching lines @@
   DERCache der_cache;
   if (!GetDERAndCacheIfNeeded(cert_handle, &der_cache))
     return false;
 
   return pickle->WriteData(
       reinterpret_cast<const char*>(der_cache.data),
       der_cache.data_length);
 }
 
 } // namespace net