Refuse to accept certificate chains containing any RSA public key smaller

net/base/x509_certificate_openssl.cc

Index: net/base/x509_certificate_openssl.cc
===================================================================
--- net/base/x509_certificate_openssl.cc	(revision 110129)
+++ net/base/x509_certificate_openssl.cc	(working copy)
@@ -619,4 +619,29 @@
       der_cache.data_length);
 }
 
+//static
+void X509Certificate::GetPublicKeyInfo(OSCertHandle cert_handle,
+                                       size_t* size_bits,
+                                       PublicKeyType* type) {
+  EVP_PKEY* key = X509_get_pubkey(cert_handle);
+  *size_bits = EVP_PKEY_size(key) * 8;
+
+  switch (key->type) {
+    case EVP_PKEY_RSA:
+      *type = PublicKeyType::RSA;
+      break;
+    case EVP_PKEY_DSA:
+      *type = PublicKeyType::DSA;
+      break;
+    case EVP_PKEY_EC:
+      *type = PublicKeyType::EC;
+      break;
+    case EVP_PKEY_DH:
+      *type = PublicKeyType::DH;
+      break;
+    default:
+      *type = PublicKeyType::NONE;
+  }
+}
+
 }  // namespace net