Certificate Transparency: Remove the obsolete invalid sct status.

net/http/http_response_info.cc

Index: net/http/http_response_info.cc
diff --git a/net/http/http_response_info.cc b/net/http/http_response_info.cc
index 4328b7ae2b64b9ab5680f67dc9fed463aebc2f00..0bf63dff16f15f4f60d45847fe7f6982ccfee58d 100644
--- a/net/http/http_response_info.cc
+++ b/net/http/http_response_info.cc
@@ -33,6 +33,10 @@ X509Certificate::PickleType GetPickleTypeForVersion(int version) {
   }
 }
 
+// 2 was used for SCT_STATUS_INVALID in SCTVerifyStatus enum but
+// was deprecated.
+uint64_t kObsoleteSCTInvalidStatus = 2;
+
 }  // namespace
 
 // These values can be bit-wise combined to form the flags field of the
@@ -239,6 +243,8 @@ bool HttpResponseInfo::InitFromPickle(const base::Pickle& pickle,
       uint16_t status;
       if (!sct.get() || !iter.ReadUInt16(&status))
         return false;
+      if (status == kObsoleteSCTInvalidStatus)
+        return false;

[Ryan Sleevi, 2016/09/01 00:01:29]

Compare this with 286-289, as an example. This present approach can still lead
to crashes (as new values are introduced & such)

Something like CheckSCTStatus() seems better for this, but lifted propertly into
sct_status_flags.cc

NET_EXPORT bool IsValidSCTStatus(int status);

And then this check can defer to it, and CheckSCTStatus could be replaced with
it.

[Eran Messeri, 2016/09/01 14:16:34]

Done.

       ssl_info.signed_certificate_timestamps.push_back(
           SignedCertificateTimestampAndStatus(
               sct, static_cast<ct::SCTVerifyStatus>(status)));