Treat failure to parse certificates as SSL protocol errors.

net/socket/ssl_client_socket_openssl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // OpenSSL binding for SSLClientSocket. The class layout and general principle
 // of operation is derived from SSLClientSocketNSS.
 
 #include "net/socket/ssl_client_socket_openssl.h"
 
 #include <errno.h>
@@ skipping 1162 matching lines @@
   GotoState(STATE_HANDSHAKE);
   return OK;
 }
 
 int SSLClientSocketOpenSSL::DoVerifyCert(int result) {
   DCHECK(!server_cert_chain_->empty());
   DCHECK(start_cert_verification_time_.is_null());
 
   GotoState(STATE_VERIFY_CERT_COMPLETE);
 
+  // OpenSSL decoded the certificate, but the platform certificate
+  // implementation could not. This is treated as a fatal SSL-level protocol
+  // error rather than a certificate error. See https://crbug.com/91341.
+  if (!server_cert_.get())
+    return ERR_SSL_SERVER_CERT_BAD_FORMAT;
+
   // If the certificate is bad and has been previously accepted, use
   // the previous status and bypass the error.
   base::StringPiece der_cert;
   if (!x509_util::GetDER(server_cert_chain_->Get(0), &der_cert)) {
     NOTREACHED();
     return ERR_CERT_INVALID;
   }
   CertStatus cert_status;
   if (ssl_config_.IsAllowedBadCert(der_cert, &cert_status)) {
     VLOG(1) << "Received an expected bad cert with status: " << cert_status;
     server_cert_verify_result_.Reset();
     server_cert_verify_result_.cert_status = cert_status;
     server_cert_verify_result_.verified_cert = server_cert_;
     return OK;
   }
 
-  // When running in a sandbox, it may not be possible to create an
-  // X509Certificate*, as that may depend on OS functionality blocked
-  // in the sandbox.
-  if (!server_cert_.get()) {
-    server_cert_verify_result_.Reset();
-    server_cert_verify_result_.cert_status = CERT_STATUS_INVALID;
-    return ERR_CERT_INVALID;
-  }
-
   std::string ocsp_response;
   if (cert_verifier_->SupportsOCSPStapling()) {
     const uint8_t* ocsp_response_raw;
     size_t ocsp_response_len;
     SSL_get0_ocsp_response(ssl_, &ocsp_response_raw, &ocsp_response_len);
     ocsp_response.assign(reinterpret_cast<const char*>(ocsp_response_raw),
                          ocsp_response_len);
   }
 
   start_cert_verification_time_ = base::TimeTicks::Now();
@@ skipping 923 matching lines @@
     OnHandshakeIOComplete(signature_result_);
     return;
   }
 
   // During a renegotiation, either Read or Write calls may be blocked on an
   // asynchronous private key operation.
   PumpReadWriteEvents();
 }
 
 }  // namespace net