Fix a leak in client_cert_resolver

chromeos/network/client_cert_util.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chromeos/network/client_cert_util.h"
 
 #include <cert.h>
 #include <pk11pub.h>
 
 #include <list>
 #include <string>
 #include <vector>
 
 #include "base/values.h"
 #include "chromeos/network/certificate_pattern.h"
 #include "net/base/net_errors.h"
 #include "net/cert/cert_database.h"
 #include "net/cert/nss_cert_database.h"
+#include "net/cert/scoped_nss_types.h"
 #include "net/cert/x509_cert_types.h"
 #include "net/cert/x509_certificate.h"
 #include "third_party/cros_system_api/dbus/service_constants.h"
 
 namespace chromeos {
 
 namespace client_cert {
 
 namespace {
 
@@ skipping 35 matching lines @@
 // Functor to filter out certs that don't have an issuer in the associated
 // IssuerCAPEMs list.
 class IssuerCaFilter {
  public:
   explicit IssuerCaFilter(const std::vector<std::string>& issuer_ca_pems)
     : issuer_ca_pems_(issuer_ca_pems) {}
   bool operator()(const scoped_refptr<net::X509Certificate>& cert) const {
     // Find the certificate issuer for each certificate.
     // TODO(gspencer): this functionality should be available from
     // X509Certificate or NSSCertDatabase.
-    CERTCertificate* issuer_cert = CERT_FindCertIssuer(
-        cert.get()->os_cert_handle(), PR_Now(), certUsageAnyCA);
+    net::ScopedCERTCertificate issuer_cert(CERT_FindCertIssuer(
+        cert.get()->os_cert_handle(), PR_Now(), certUsageAnyCA));
 
     if (!issuer_cert)
       return true;
 
     std::string pem_encoded;
-    if (!net::X509Certificate::GetPEMEncoded(issuer_cert, &pem_encoded)) {
+    if (!net::X509Certificate::GetPEMEncoded(issuer_cert.get(),
+                                             &pem_encoded)) {
       LOG(ERROR) << "Couldn't PEM-encode certificate.";
       return true;
     }
 
     return (std::find(issuer_ca_pems_.begin(), issuer_ca_pems_.end(),
                       pem_encoded) ==
             issuer_ca_pems_.end());
   }
  private:
   const std::vector<std::string>& issuer_ca_pems_;
@@ skipping 178 matching lines @@
       return !cert_id.empty() && !key_id.empty() && !identity.empty();
     }
   }
   NOTREACHED();
   return false;
 }
 
 }  // namespace client_cert
 
 }  // namespace chromeos