Fix build break with uninitialized variable 'ev_policy_tag'....

net/base/x509_certificate_nss.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/x509_certificate.h"
 
 // Work around https://bugzilla.mozilla.org/show_bug.cgi?id=455424
 // until NSS 3.12.2 comes out and we update to it.
 #define Lock FOO_NSS_Lock
 #include <cert.h>
@@ skipping 301 matching lines @@
       result->push_back(value);
     }
     name = CERT_GetNextGeneralName(name);
     if (name == alt_name_list)
       break;
   }
   PORT_FreeArena(arena, PR_FALSE);
   PORT_Free(alt_name.data);
 }
 
-// TODO(ukai): make a Linux-only method of the EVRootCAMetadata.
+// TODO(ukai): this should be a Linux-only method of EVRootCAMetadata class.
 void GetPolicyOidTags(net::EVRootCAMetadata* metadata,
                       std::vector<SECOidTag>* policies) {
   const char* const* policy_oids = metadata->GetPolicyOIDs();
   for (int i = 0; i < metadata->NumPolicyOIDs(); i++) {
     PRUint8 buf[1024];
     SECItem oid_item;
     oid_item.data = buf;
     oid_item.len = sizeof(buf);
     SECStatus status = SEC_StringToOID(NULL, &oid_item, policy_oids[i], 0);
     if (status != SECSuccess) {
@@ skipping 13 matching lines @@
       policy = SECOID_AddEntry(&od);
       DCHECK(policy != SEC_OID_UNKNOWN);
     }
     policies->push_back(policy);
   }
   return;
 }
 
 // Call CERT_PKIXVerifyCert for the cert_handle.
 // Verification results are stored in an array of CERTValOutParam.
-// If metadata is not NULL, policies are also checked.
+// If policy_oids is not NULL and num_policy_oids is positive, policies
+// are also checked.
 // Caller must initialize cvout before calling this function.
 SECStatus PKIXVerifyCert(X509Certificate::OSCertHandle cert_handle,
                          const SECOidTag* policy_oids,
                          int num_policy_oids,
                          CERTValOutParam* cvout) {
   PRUint64 revocation_method_flags =
       CERT_REV_M_TEST_USING_THIS_METHOD |
       CERT_REV_M_ALLOW_NETWORK_FETCHING |
       CERT_REV_M_ALLOW_IMPLICIT_DEFAULT_SOURCE |
       CERT_REV_M_REQUIRE_INFO_ON_MISSING_SOURCE |
@@ skipping 86 matching lines @@
   }
   CERTCertificatePolicies* policies =
       CERT_DecodeCertificatePoliciesExtension(&policy_ext);
   if (!policies) {
     LOG(ERROR) << "Failed to decode certificate policy.";
     return false;
   }
   CERTPolicyInfo** policy_infos = policies->policyInfos;
   while (*policy_infos != NULL) {
     CERTPolicyInfo* policy_info = *policy_infos++;
-    SECOidTag oid_tag = SECOID_FindOIDTag(&policy_info->policyID);
+    SECOidTag oid_tag = policy_info->oid;
     if (oid_tag == SEC_OID_UNKNOWN)
       continue;
     if (oid_tag == ev_policy_tag)
       return true;
   }
   LOG(ERROR) << "No EV Policy Tag";
   return false;
 }
 
 }  // namespace
@@ skipping 79 matching lines @@
       err = SEC_ERROR_EXPIRED_CERTIFICATE;
     verify_result->cert_status |= MapCertErrorToCertStatus(err);
     return MapCertStatusToNetError(verify_result->cert_status);
   }
 
   GetCertChainInfo(cvout[cvout_cert_list_index].value.pointer.chain,
                    verify_result);
   if (IsCertStatusError(verify_result->cert_status))
     return MapCertStatusToNetError(verify_result->cert_status);
 
-  if (flags & VERIFY_EV_CERT) {
-    if (VerifyEV())
-      verify_result->cert_status |= CERT_STATUS_IS_EV;
-  }
+  if ((flags & VERIFY_EV_CERT) && VerifyEV())
+    verify_result->cert_status |= CERT_STATUS_IS_EV;
   return OK;
 }
 
-// Studied Mozilla's code (esp. security/manager/ssl/src/nsNSSCertHelper.cpp)
-// to learn how to verify EV certificate.
+// Studied Mozilla's code (esp. security/manager/ssl/src/nsIdentityChecking.cpp
+// and nsNSSCertHelper.cpp) to learn how to verify EV certificate.
 // TODO(wtc): We may be able to request cert_po_policyOID and just
 // check if any of the returned policies is the EV policy of the trust anchor.
 // Another possible optimization is that we get the trust anchor from
 // the first PKIXVerifyCert call.  We look up the EV policy for the trust
 // anchor.  If the trust anchor has no EV policy, we know the cert isn't EV.
 // Otherwise, we pass just that EV policy (as opposed to all the EV policies)
 // to the second PKIXVerifyCert call.
 bool X509Certificate::VerifyEV() const {
   net::EVRootCAMetadata* metadata = net::EVRootCAMetadata::GetInstance();
 
@@ skipping 12 matching lines @@
                                     &policies[0], policies.size(), cvout);
   if (status != SECSuccess)
     return false;
 
   CERTCertificate* root_ca =
       cvout[cvout_trust_anchor_index].value.pointer.cert;
   if (root_ca == NULL)
     return false;
   X509Certificate::Fingerprint fingerprint =
       X509Certificate::CalculateFingerprint(root_ca);
-  SECOidTag ev_policy_tag;

[wtc, 2009/08/07 18:07:48]

Does the compiler warn about this?  We're passing
&ev_policy_tag as an output parameter to
GetEvPolicyOidTag, so ev_policy_tag doesn't need to be
initialized.

[ukai, 2009/08/10 04:09:20]

Yes, it caused the build break.

+  SECOidTag ev_policy_tag = SEC_OID_UNKNOWN;
   if (!GetEvPolicyOidTag(metadata, fingerprint, &ev_policy_tag))
     return false;
 
   if (!CheckCertPolicies(cert_handle_, ev_policy_tag))
     return false;
 
   return true;
 }
 
 // static
@@ skipping 23 matching lines @@
   DCHECK(0 != cert->derCert.len);
 
   SECStatus rv = HASH_HashBuf(HASH_AlgSHA1, sha1.data,
                               cert->derCert.data, cert->derCert.len);
   DCHECK(rv == SECSuccess);
 
   return sha1;
 }
 
 }  // namespace net