Check self-signed certificate names and signatures

net/cert/x509_certificate_ios.cc

Index: net/cert/x509_certificate_ios.cc
diff --git a/net/cert/x509_certificate_ios.cc b/net/cert/x509_certificate_ios.cc
index 553c63a4281a43ba93b7a6298579f9a153f0afeb..6cd894f19ec0c5b5f404ab0abbaa7738e603b0ed 100644
--- a/net/cert/x509_certificate_ios.cc
+++ b/net/cert/x509_certificate_ios.cc
@@ -468,7 +468,14 @@ bool X509Certificate::IsSelfSigned(OSCertHandle os_cert) {
     return false;
 
   // NOTE: X509_verify() returns 1 in case of success, 0 or -1 on error.
-  return X509_verify(cert.get(), scoped_key.get()) == 1;
+  if ((X509_verify(cert.get(), scoped_key.get())) != 1) {

[estark, 2016/05/20 18:37:53]

nit: as much as it pains me personally, use no curly brackets for single-line
bodies to be consistent with the rest of the file

[dadrian, 2016/05/20 19:01:21]

Done, though I wash my hands of all responsibility for goto-fail style bugs :)

+    return false;
+  }
+  // NOTE: x509_check_issued returns X509_V_OK in case of success
+  if (X509_check_issued(cert.get(), cert.get()) != X509_V_OK) {

[svaldez, 2016/05/20 17:54:52]

Consider:
return X509_check_issued...

[dadrian, 2016/05/20 19:01:21]

Done.

+    return false;
+  }
+  return true;
 }
 
 }  // namespace net