Account for the OS returning an empty certificate chain.

net/cert/cert_verify_proc_mac.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/cert_verify_proc_mac.h"
 
 #include <CommonCrypto/CommonDigest.h>
 #include <CoreServices/CoreServices.h>
 #include <Security/Security.h>
 
@@ skipping 166 matching lines @@
 
 // Stores the constructed certificate chain |cert_chain| and information about
 // the signature algorithms used into |*verify_result|. If the leaf cert in
 // |cert_chain| contains a weak (MD2, MD4, MD5, SHA-1) signature, stores that
 // in |*leaf_is_weak|.
 void GetCertChainInfo(CFArrayRef cert_chain,
                       CSSM_TP_APPLE_EVIDENCE_INFO* chain_info,
                       CertVerifyResult* verify_result,
                       bool* leaf_is_weak) {
   *leaf_is_weak = false;
-  verify_result->verified_cert = nullptr;
   verify_result->has_md2 = false;
   verify_result->has_md4 = false;
   verify_result->has_md5 = false;
   verify_result->has_sha1 = false;
 
+  // If certificate verification fails unrecoverably, OS X will return an
+  // empty chain. CertVerifyResult is expected to contain the original
+  // certificate chain in this case, so leave |verify_result->verified_cert|
+  // unchanged.
+  if (CFArrayGetCount(cert_chain) == 0)
+    return;
+
   SecCertificateRef verified_cert = NULL;
   std::vector<SecCertificateRef> verified_chain;
   for (CFIndex i = 0, count = CFArrayGetCount(cert_chain); i < count; ++i) {
     SecCertificateRef chain_cert = reinterpret_cast<SecCertificateRef>(
         const_cast<void*>(CFArrayGetValueAtIndex(cert_chain, i)));
     if (i == 0) {
       verified_cert = chain_cert;
     } else {
       verified_chain.push_back(chain_cert);
     }
@@ skipping 43 matching lines @@
                CSSMOIDEqual(alg_oid, &CSSMOID_SHA1WithRSA_OIW) ||
                CSSMOIDEqual(alg_oid, &CSSMOID_SHA1WithDSA) ||
                CSSMOIDEqual(alg_oid, &CSSMOID_SHA1WithDSA_CMS) ||
                CSSMOIDEqual(alg_oid, &CSSMOID_SHA1WithDSA_JDK) ||
                CSSMOIDEqual(alg_oid, &CSSMOID_ECDSA_WithSHA1)) {
       verify_result->has_sha1 = true;
       if (i == 0)
         *leaf_is_weak = true;
     }
   }
-  if (!verified_cert)
+  if (!verified_cert) {
+    NOTREACHED();
     return;
+  }
 
   verify_result->verified_cert =
       X509Certificate::CreateFromHandle(verified_cert, verified_chain);
 }
 
 void AppendPublicKeyHashes(CFArrayRef chain,
                            HashValueVector* hashes) {
   const CFIndex n = CFArrayGetCount(chain);
   for (CFIndex i = 0; i < n; i++) {
     SecCertificateRef cert = reinterpret_cast<SecCertificateRef>(
@@ skipping 180 matching lines @@
   status = SecTrustEvaluate(tmp_trust, &tmp_trust_result);
   if (status)
     return NetErrorFromOSStatus(status);
   CFArrayRef tmp_verified_chain = NULL;
   CSSM_TP_APPLE_EVIDENCE_INFO* tmp_chain_info;
   status = SecTrustGetResult(tmp_trust, &tmp_trust_result, &tmp_verified_chain,
                              &tmp_chain_info);
   if (status)
     return NetErrorFromOSStatus(status);
 
+  // SecTrustGetResult may return an empty verified chain on some fatal
+  // errors. Guard against any library bugs which may return it in cases where
+  // a chain is expected.
+  if (CFArrayGetCount(tmp_verified_chain) == 0 ||
+      (temp_trust_result == kSecTrustResultUnspecified ||
+       temp_trust_result == kSecTrustResultProceed ||
+       temp_trust_result == kSecTrustResultRecoverableTrustFailure)) {
+    NOTREACHED();
+    return ERR_FAILED;
+  }

[davidben, 2015/04/18 00:23:40]

This isn't necessary, but I was a little worried about the empty chain getting
returned when it wasn't supposed it. It seemed slightly poor.

+
   trust_ref->swap(scoped_tmp_trust);
   *trust_result = tmp_trust_result;
   verified_chain->reset(tmp_verified_chain);
   *chain_info = tmp_chain_info;
 
   return OK;
 }
 
 }  // namespace
 
@@ skipping 297 matching lines @@
           }
         }
       }
     }
   }
 
   return OK;
 }
 
 }  // namespace net