Fix a leak in client_cert_resolver

chromeos/network/client_cert_resolver.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chromeos/network/client_cert_resolver.h"
 
 #include <cert.h>
 #include <certt.h>  // for (SECCertUsageEnum) certUsageAnyCA
 #include <pk11pub.h>
 
@@ skipping 12 matching lines @@
 #include "chromeos/dbus/shill_service_client.h"
 #include "chromeos/network/certificate_pattern.h"
 #include "chromeos/network/client_cert_util.h"
 #include "chromeos/network/favorite_state.h"
 #include "chromeos/network/managed_network_configuration_handler.h"
 #include "chromeos/network/network_state_handler.h"
 #include "chromeos/network/network_ui_data.h"
 #include "chromeos/tpm_token_loader.h"
 #include "components/onc/onc_constants.h"
 #include "dbus/object_path.h"
+#include "net/cert/scoped_nss_types.h"
 #include "net/cert/x509_certificate.h"
 
 namespace chromeos {
 
 // Describes a network |network_path| for which a matching certificate |cert_id|
 // was found.
 struct ClientCertResolver::NetworkAndMatchingCert {
   NetworkAndMatchingCert(const std::string& network_path,
                          client_cert::ConfigType config_type,
                          const std::string& cert_id)
@@ skipping 97 matching lines @@
   // Filter all client certs and determines each certificate's issuer, which is
   // required for the pattern matching.
   std::vector<CertAndIssuer> client_certs;
   for (net::CertificateList::const_iterator it = certs.begin();
        it != certs.end(); ++it) {
     const net::X509Certificate& cert = **it;
     if (cert.valid_expiry().is_null() || cert.HasExpired() ||
         !HasPrivateKey(cert)) {
       continue;
     }
-    net::X509Certificate::OSCertHandle issuer_handle =
-        CERT_FindCertIssuer(cert.os_cert_handle(), PR_Now(), certUsageAnyCA);
+    net::ScopedCERTCertificate issuer_handle(
+        CERT_FindCertIssuer(cert.os_cert_handle(), PR_Now(), certUsageAnyCA));
     if (!issuer_handle) {
       LOG(ERROR) << "Couldn't find an issuer.";
       continue;
     }
     scoped_refptr<net::X509Certificate> issuer =
         net::X509Certificate::CreateFromHandle(
-            issuer_handle,
+            issuer_handle.get(),
             net::X509Certificate::OSCertHandles() /* no intermediate certs */);
     if (!issuer) {
       LOG(ERROR) << "Couldn't create issuer cert.";
       continue;
     }
     std::string pem_encoded_issuer;
     if (!net::X509Certificate::GetPEMEncoded(issuer->os_cert_handle(),
                                              &pem_encoded_issuer)) {
       LOG(ERROR) << "Couldn't PEM-encode certificate.";
       continue;
@@ skipping 275 matching lines @@
     DBusThreadManager::Get()->GetShillServiceClient()->
         SetProperties(dbus::ObjectPath(it->service_path),
                         shill_properties,
                         base::Bind(&base::DoNothing),
                         base::Bind(&LogError, it->service_path));
     network_state_handler_->RequestUpdateForNetwork(it->service_path);
   }
 }
 
 }  // namespace chromeos