Ensure X509Certificate::OSCertHandles are safe to be used on both UI and IO threads on Win

net/base/x509_certificate_openssl.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/x509_certificate.h"
 
 #include <openssl/asn1.h>
 #include <openssl/crypto.h>
 #include <openssl/obj_mac.h>
 #include <openssl/pem.h>
@@ skipping 305 matching lines @@
 }
 
 // static
 void X509Certificate::FreeOSCertHandle(OSCertHandle cert_handle) {
   // Decrement the ref-count for the cert and, if all references are gone,
   // free the memory and any application-specific data associated with the
   // certificate.
   X509_free(cert_handle);
 }
 
+// static
+void X509Certificate::FreeOSCertListHandle(
+    OSCertListHandle cert_list_handle) {
+  sk_X509_pop_free(cert_list_handle, X509_free);
+}
+
 void X509Certificate::Initialize() {
   crypto::EnsureOpenSSLInit();
   fingerprint_ = CalculateFingerprint(cert_handle_);
 
   ASN1_INTEGER* num = X509_get_serialNumber(cert_handle_);
   if (num) {
     serial_number_ = std::string(
         reinterpret_cast<char*>(num->data),
         num->length);
     // Remove leading zeros.
@@ skipping 15 matching lines @@
 SHA1Fingerprint X509Certificate::CalculateFingerprint(OSCertHandle cert) {
   SHA1Fingerprint sha1;
   unsigned int sha1_size = static_cast<unsigned int>(sizeof(sha1.data));
   int ret = X509_digest(cert, EVP_sha1(), sha1.data, &sha1_size);
   CHECK(ret);
   CHECK_EQ(sha1_size, sizeof(sha1.data));
   return sha1;
 }
 
 // static
+X509Certificate::OSCertListHandle
+X509Certificate::CreateOSCertListHandle() const {
+  STACK_OF(X509)* cert_list_handle = sk_X509_new_null();
+  if (!cert_list_handle)
+    return NULL;
+
+  if (!sk_X509_push(cert_list_handle, DupOSCertHandle(cert_handle_))) {
+    FreeOSCertListHandle(cert_list_handle);
+    return NULL;
+  }
+
+  bool ok = true;
+  for (size_t i = 0; i < intermediate_ca_certs_.size(); ++i) {
+    if (!sk_X509_push(cert_list_handle,
+                      DupOSCertHandle(intermediate_ca_certs_[i]))) {
+      ok = false;
+      break;
+    }
+  }
+  if (!ok) {
+    FreeOSCertListHandle(cert_list_handle);
+    return NULL;
+  }
+
+  return cert_list_handle;
+}
+
+// static
 X509Certificate::OSCertHandle X509Certificate::CreateOSCertHandleFromBytes(
     const char* data, int length) {
   if (length < 0)
     return NULL;
   crypto::EnsureOpenSSLInit();
   const unsigned char* d2i_data =
       reinterpret_cast<const unsigned char*>(data);
   // Don't cache this data via SetDERCache as this wire format may be not be
   // identical from the i2d_X509 roundtrip.
   X509* cert = d2i_X509(NULL, &d2i_data, length);
@@ skipping 70 matching lines @@
 int X509Certificate::VerifyInternal(const std::string& hostname,
                                     int flags,
                                     CertVerifyResult* verify_result) const {
   if (!VerifyNameMatch(hostname))
     verify_result->cert_status |= CERT_STATUS_COMMON_NAME_INVALID;
 
   crypto::ScopedOpenSSL<X509_STORE_CTX, X509_STORE_CTX_free> ctx(
       X509_STORE_CTX_new());
 
   crypto::ScopedOpenSSL<STACK_OF(X509), sk_X509_free_fn> intermediates(
-      sk_X509_new_null());
+      CreateOSCertListHandle());
   if (!intermediates.get())
     return ERR_OUT_OF_MEMORY;
 
-  for (OSCertHandles::const_iterator it = intermediate_ca_certs_.begin();
-       it != intermediate_ca_certs_.end(); ++it) {
-    if (!sk_X509_push(intermediates.get(), *it))
-      return ERR_OUT_OF_MEMORY;
-  }
   int rv = X509_STORE_CTX_init(ctx.get(), cert_store(),
                                cert_handle_, intermediates.get());
   CHECK_EQ(1, rv);
 
   if (X509_verify_cert(ctx.get()) != 1) {
     int x509_error = X509_STORE_CTX_get_error(ctx.get());
     CertStatus cert_status = MapCertErrorToCertStatus(x509_error);
     LOG(ERROR) << "X509 Verification error "
         << X509_verify_cert_error_string(x509_error)
         << " : " << x509_error
@@ skipping 94 matching lines @@
   DERCache der_cache;
   if (!GetDERAndCacheIfNeeded(cert_handle, &der_cache))
     return false;
 
   return pickle->WriteData(
       reinterpret_cast<const char*>(der_cache.data),
       der_cache.data_length);
 }
 
 }  // namespace net