Don't use X509Certificate in SSLConfig.

net/http/http_stream_factory_impl_job.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_stream_factory_impl_job.h"
 
 #include "base/logging.h"
 #include "base/stl_util-inl.h"
 #include "base/string_util.h"
 #include "base/stringprintf.h"
@@ skipping 995 matching lines @@
 
   SSLClientSocket* ssl_socket =
       static_cast<SSLClientSocket*>(connection_->socket());
   ssl_socket->GetSSLInfo(&ssl_info_);
 
   // Add the bad certificate to the set of allowed certificates in the
   // SSL config object. This data structure will be consulted after calling
   // RestartIgnoringLastError(). And the user will be asked interactively
   // before RestartIgnoringLastError() is ever called.
   SSLConfig::CertAndStatus bad_cert;
-  bad_cert.cert = ssl_info_.cert;
+  if (ssl_info_.cert == NULL ||
+      !ssl_info_.cert->GetDEREncoded(&bad_cert.cert_der))
+    return error;

[wtc, 2011/07/19 21:57:01]

Are you sure ssl_info_.cert may be NULL here?  I don't
think this function is executed in the sandbox.

Please add a comment to explain why ssl_info.cert may be
NULL.

[Sergey Ulanov, 2011/07/19 23:50:21]

Normally ssl_info.cert should not be set to NULL, but there might be some cases
when it is NULL. We may fail to create X509Certificate for reasons other than
running in sandbox, for example when OS runs out of disk space, etc. - we don't
want chrome to crash in that case. Added comments.

   bad_cert.cert_status = ssl_info_.cert_status;
   ssl_config_.allowed_bad_certs.push_back(bad_cert);
 
   int load_flags = request_info_.load_flags;
   if (HttpStreamFactory::ignore_certificate_errors())
     load_flags |= LOAD_IGNORE_ALL_CERT_ERRORS;
   if (ssl_socket->IgnoreCertError(error, load_flags))
     return OK;
   return error;
 }
@@ skipping 83 matching lines @@
                << (using_spdy ? "true\n" : "false\n");
   }
 }
 
 #if defined(OS_WIN)
 #pragma optimize( "", on )
 #pragma warning (default: 4748)
 #endif
 
 }  // namespace net