Call CryptSignHash twice in client certificate logic.

net/ssl/openssl_platform_key_win.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/ssl/openssl_platform_key.h"
 
 #include <windows.h>
 #include <NCrypt.h>
 
 #include <string.h>
@@ skipping 299 matching lines @@
   }
   if (hash_len != in_len) {
     OpenSSLPutNetError(FROM_HERE, ERR_SSL_CLIENT_AUTH_SIGNATURE_FAILED);
     return 0;
   }
   if (!CryptSetHashParam(hash.get(), HP_HASHVAL, const_cast<BYTE*>(in), 0)) {
     PLOG(ERROR) << "CryptSetHashParam HP_HASHVAL failed";
     OpenSSLPutNetError(FROM_HERE, ERR_SSL_CLIENT_AUTH_SIGNATURE_FAILED);
     return 0;
   }
-  DWORD signature_len = RSA_size(rsa);
+  // Determine the output length.
+  DWORD signature_len = 0;
+  if (!CryptSignHash(hash.get(), ex_data->key->dwKeySpec, nullptr, 0, nullptr,
+                     &signature_len)) {
+    PLOG(ERROR) << "CryptSignHash failed";
+    OpenSSLPutNetError(FROM_HERE, ERR_SSL_CLIENT_AUTH_SIGNATURE_FAILED);
+    return 0;
+  }
+  if (signature_len == 0 || signature_len > RSA_size(rsa)) {
+    LOG(ERROR) << "Bad signature length";
+    OpenSSLPutNetError(FROM_HERE, ERR_SSL_CLIENT_AUTH_SIGNATURE_FAILED);
+    return 0;
+  }
+  // Sign the hash.
   if (!CryptSignHash(hash.get(), ex_data->key->dwKeySpec, nullptr, 0, out,
                      &signature_len)) {
     PLOG(ERROR) << "CryptSignHash failed";
     OpenSSLPutNetError(FROM_HERE, ERR_SSL_CLIENT_AUTH_SIGNATURE_FAILED);
     return 0;
   }
 
   /* CryptoAPI signs in little-endian, so reverse it. */
   std::reverse(out, out + signature_len);
   *out_len = signature_len;
@@ skipping 304 matching lines @@
     case EVP_PKEY_RSA:
       return CreateRSAWrapper(key.Pass(), key_length);
     case EVP_PKEY_EC:
       return CreateECDSAWrapper(key.Pass(), key_length);
     default:
       return nullptr;
   }
 }
 
 }  // namespace net