Treat failure to parse certificates as SSL protocol errors.

net/socket/ssl_client_socket_unittest.cc

Index: net/socket/ssl_client_socket_unittest.cc
diff --git a/net/socket/ssl_client_socket_unittest.cc b/net/socket/ssl_client_socket_unittest.cc
index 8eec65792cf5c93e23fe1871c33089b7d9711863..77a0aab72aeb2fc5cb65696e72fbd5d7e3127e47 100644
--- a/net/socket/ssl_client_socket_unittest.cc
+++ b/net/socket/ssl_client_socket_unittest.cc
@@ -1102,6 +1102,27 @@ TEST_F(SSLClientSocketTest, ConnectMismatched) {
   EXPECT_TRUE(LogContainsEndEvent(entries, -1, NetLog::TYPE_SSL_CONNECT));
 }
 
+#if defined(OS_WIN)

[Ryan Sleevi, 2015/08/12 22:03:19]

Why only Windows?

Suggest you go for the multi-platform parse failure ;)

8K+ RSA key (OS X), validity range of 0000 to 9999 (Windows). I think the
validity range might also cause NSS to choke. I think an id-rsa-PSS cert might
cause NSS to choke as well, but that'd probably cause BoringSSL to choke.

[davidben, 2015/08/12 22:14:05]

That doesn't work. It's not a parse failure. It parses, but the verifier fails
with a fatal error later. That's why I couldn't use it to repro the crash on my
Mac and why the Mac bug was not a duplicate of this one.
Already there.
In that case, how did we ever have this crash pre-BoringSSL? An NSS choke would
not have triggered the crash.
BoringSSL will not accept id-rsa-PSS in the SPKI. It is okay in the signature
algorithms though.

+// Tests that certificates parsable by SSLClientSocket's internal SSL
+// implementation, but not X509Certificate are treated as fatal non-certificate
+// errors. This is regression test for https://crbug.com/91341.
+TEST_F(SSLClientSocketTest, ConnectBadValidity) {
+  SpawnedTestServer::SSLOptions ssl_options(
+      SpawnedTestServer::SSLOptions::CERT_BAD_VALIDITY);
+  ASSERT_TRUE(ConnectToTestServer(ssl_options));
+  SSLConfig ssl_config;
+  int rv;
+  ASSERT_TRUE(CreateAndConnectSSLClientSocket(ssl_config, &rv));
+
+  EXPECT_EQ(ERR_SSL_SERVER_CERT_BAD_FORMAT, rv);
+  EXPECT_FALSE(IsCertificateError(rv));
+
+  SSLInfo ssl_info;
+  ASSERT_TRUE(sock_->GetSSLInfo(&ssl_info));
+  EXPECT_FALSE(ssl_info.cert);
+}
+#endif  // defined(OS_WIN)
+
 // Attempt to connect to a page which requests a client certificate. It should
 // return an error code on connect.
 TEST_F(SSLClientSocketTest, ConnectClientAuthCertRequested) {