Fix a crash in net::SSLClientSocketWin::OnIOComplete(int) when...

net/socket/ssl_client_socket_win.h

 // Copyright (c) 2006-2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_SOCKET_SSL_CLIENT_SOCKET_WIN_H_
 #define NET_SOCKET_SSL_CLIENT_SOCKET_WIN_H_
 
 #define SECURITY_WIN32  // Needs to be defined before including security.h
 
 #include <windows.h>
 #include <wincrypt.h>
 #include <security.h>
 
 #include <string>
 
 #include "base/scoped_ptr.h"
-#include "net/base/cert_verifier.h"
 #include "net/base/cert_verify_result.h"
 #include "net/base/completion_callback.h"
 #include "net/base/ssl_config_service.h"
 #include "net/socket/ssl_client_socket.h"
 
 namespace net {
 
+class CertVerifier;
+
 // An SSL client socket implemented with the Windows Schannel.
 class SSLClientSocketWin : public SSLClientSocket {
  public:
   // Takes ownership of the transport_socket, which may already be connected.
   // The given hostname will be compared with the name(s) in the server's
   // certificate during the SSL handshake.  ssl_config specifies the SSL
   // settings.
   SSLClientSocketWin(ClientSocket* transport_socket,
                      const std::string& hostname,
                      const SSLConfig& ssl_config);
@@ skipping 62 matching lines @@
     STATE_PAYLOAD_ENCRYPT,
     STATE_PAYLOAD_WRITE,
     STATE_PAYLOAD_WRITE_COMPLETE,
     STATE_PAYLOAD_READ,
     STATE_PAYLOAD_READ_COMPLETE,
   };
   State next_state_;
 
   SecPkgContext_StreamSizes stream_sizes_;
   scoped_refptr<X509Certificate> server_cert_;
-  CertVerifier verifier_;
+  scoped_ptr<CertVerifier> verifier_;
   CertVerifyResult server_cert_verify_result_;
 
   CredHandle* creds_;
   CtxtHandle ctxt_;
   SecBuffer in_buffers_[2];  // Input buffers for InitializeSecurityContext.
   SecBuffer send_buffer_;  // Output buffer for InitializeSecurityContext.
   SECURITY_STATUS isc_status_;  // Return value of InitializeSecurityContext.
   scoped_array<char> payload_send_buffer_;
   int payload_send_buffer_len_;
   int bytes_sent_;
@@ skipping 30 matching lines @@
   // to be interpreted as EOF.
   bool ignore_ok_result_;
 
   // Renegotiation is in progress.
   bool renegotiating_;
 };
 
 }  // namespace net
 
 #endif  // NET_SOCKET_SSL_CLIENT_SOCKET_WIN_H_