net: fix crash when failing to import a client-side cert into NSS.

net/socket/ssl_client_socket_nss.cc

Index: net/socket/ssl_client_socket_nss.cc
diff --git a/net/socket/ssl_client_socket_nss.cc b/net/socket/ssl_client_socket_nss.cc
index 879689ad6dd149d58a656858cf558d424074efd1..23ffa7101592ce3f83247db99b57c46c3ade489b 100644
--- a/net/socket/ssl_client_socket_nss.cc
+++ b/net/socket/ssl_client_socket_nss.cc
@@ -2166,6 +2166,13 @@ SECStatus SSLClientSocketNSS::PlatformClientAuthHandler(
         CERTCertDBHandle* db_handle = CERT_GetDefaultCertDB();
         CERTCertificate* user_cert = CERT_NewTempCertificate(
             db_handle, &der_cert, NULL, PR_FALSE, PR_TRUE);
+        if (!user_cert) {
+          // Importing the certificate can fail for reasons including a serial
+          // number collision. See crbug.com/97355.
+          CERT_DestroyCertList(*result_certs);
+          *result_certs = NULL;
+          return SECFailure;
+        }
         CERT_AddCertToListTail(*result_certs, user_cert);
 
         // Add the intermediates.
@@ -2178,6 +2185,11 @@ SECStatus SSLClientSocketNSS::PlatformClientAuthHandler(
 
           CERTCertificate* intermediate = CERT_NewTempCertificate(
               db_handle, &der_cert, NULL, PR_FALSE, PR_TRUE);
+          if (!intermediate) {
+            CERT_DestroyCertList(*result_certs);
+            *result_certs = NULL;
+            return SECFailure;
+          }
           CERT_AddCertToListTail(*result_certs, intermediate);
         }
         *result_private_key = key_context;
@@ -2320,6 +2332,11 @@ SECStatus SSLClientSocketNSS::PlatformClientAuthHandler(
           der_cert.len = cert_data.Length;
           CERTCertificate* nss_cert = CERT_NewTempCertificate(
               CERT_GetDefaultCertDB(), &der_cert, NULL, PR_FALSE, PR_TRUE);
+          if (!nss_cert) {
+            // In the event of an NSS error we make up an OS error and reuse
+            // the error handling, below.
+            os_error = errKCCreateChainFailed;

[mattm, 2011/09/22 21:31:19]

Do we need a break here?

[agl, 2011/09/22 22:07:09]

I don't think so but, on the other hand, why not? Done.

+          }
           CERT_AddCertToListTail(*result_certs, nss_cert);
         }
       }