Don't use X509Certificate in SSLConfig.

net/base/x509_certificate.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/x509_certificate.h"
 
 #include <stdlib.h>
 
 #include <algorithm>
 #include <map>
@@ skipping 244 matching lines @@
 
 // static
 X509Certificate* X509Certificate::CreateFromDERCertChain(
     const std::vector<base::StringPiece>& der_certs) {
   if (der_certs.empty())
     return NULL;
 
   X509Certificate::OSCertHandles intermediate_ca_certs;
   for (size_t i = 1; i < der_certs.size(); i++) {
     OSCertHandle handle = CreateOSCert(der_certs[i]);
-    DCHECK(handle);
+    if (!handle)
+      break;
     intermediate_ca_certs.push_back(handle);
   }
 
-  OSCertHandle handle = CreateOSCert(der_certs[0]);
-  DCHECK(handle);
-  X509Certificate* cert = CreateFromHandle(handle, intermediate_ca_certs);
-  FreeOSCertHandle(handle);
+  OSCertHandle handle = NULL;
+  // Return NULL if we failed to parse any of the certs.
+  if (der_certs.size() - 1 == intermediate_ca_certs.size())
+    handle = CreateOSCert(der_certs[0]);
+
+  X509Certificate* cert = NULL;
+  if (handle) {
+    cert = CreateFromHandle(handle, intermediate_ca_certs);
+    FreeOSCertHandle(handle);
+  }
+
   for (size_t i = 0; i < intermediate_ca_certs.size(); i++)
     FreeOSCertHandle(intermediate_ca_certs[i]);
 
   return cert;
 }
 
 // static
 X509Certificate* X509Certificate::CreateFromBytes(const char* data,
                                                   int length) {
   OSCertHandle cert_handle = CreateOSCertHandleFromBytes(data, length);
@@ skipping 399 matching lines @@
 bool X509Certificate::IsSHA1HashInSortedArray(const SHA1Fingerprint& hash,
                                               const uint8* array,
                                               size_t array_byte_len) {
   DCHECK_EQ(0u, array_byte_len % base::SHA1_LENGTH);
   const unsigned arraylen = array_byte_len / base::SHA1_LENGTH;
   return NULL != bsearch(hash.data, array, arraylen, base::SHA1_LENGTH,
                          CompareSHA1Hashes);
 }
 
 }  // namespace net