Resolve a TSAN race in CertVerifyProc

net/cert/cert_verify_proc.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/cert_verify_proc.h"
 
 #include <stdint.h>
 
 #include <algorithm>
 
@@ skipping 372 matching lines @@
   return new CertVerifyProcIOS();
 #elif defined(OS_MACOSX)
   return new CertVerifyProcMac();
 #elif defined(OS_WIN)
   return new CertVerifyProcWin();
 #else
   return NULL;
 #endif
 }
 
-CertVerifyProc::CertVerifyProc() {}
+CertVerifyProc::CertVerifyProc()
+    : sha1_legacy_mode_enabled(base::FeatureList::IsEnabled(kSHA1LegacyMode)) {}
 
 CertVerifyProc::~CertVerifyProc() {}
 
 int CertVerifyProc::Verify(X509Certificate* cert,
                            const std::string& hostname,
                            const std::string& ocsp_response,
                            int flags,
                            CRLSet* crl_set,
                            const CertificateList& additional_trust_anchors,
                            CertVerifyResult* verify_result) {
@@ skipping 78 matching lines @@
   // As the risk is greatest for publicly trusted certificates, prevent
   // those certificates from being trusted from that date forward.
   //
   // TODO(mattm): apply the SHA-1 deprecation check to all certs unless
   // CertVerifier::VERIFY_ENABLE_SHA1_LOCAL_ANCHORS flag is present.
   if (verify_result->has_md5 ||
       // Current SHA-1 behaviour:
       // - Reject all publicly trusted SHA-1
       // - ... unless it's in the intermediate and SHA-1 intermediates are
       //   allowed for that platform. See https://crbug.com/588789
-      (!base::FeatureList::IsEnabled(kSHA1LegacyMode) &&
+      (!sha1_legacy_mode_enabled &&
        (verify_result->is_issued_by_known_root &&
         (verify_result->has_sha1_leaf ||
          (verify_result->has_sha1 && !AreSHA1IntermediatesAllowed())))) ||
       // Legacy SHA-1 behaviour:
       // - Reject all publicly trusted SHA-1 leaf certs issued after
       //   2016-01-01.
-      (base::FeatureList::IsEnabled(kSHA1LegacyMode) &&
-       (verify_result->has_sha1_leaf &&
-        verify_result->is_issued_by_known_root &&
-        IsPastSHA1DeprecationDate(*cert)))) {
+      (sha1_legacy_mode_enabled && (verify_result->has_sha1_leaf &&
+                                    verify_result->is_issued_by_known_root &&
+                                    IsPastSHA1DeprecationDate(*cert)))) {
     verify_result->cert_status |= CERT_STATUS_WEAK_SIGNATURE_ALGORITHM;
     // Avoid replacing a more serious error, such as an OS/library failure,
     // by ensuring that if verification failed, it failed with a certificate
     // error.
     if (rv == OK || IsCertificateError(rv))
       rv = MapCertStatusToNetError(verify_result->cert_status);
   }
 
   // Flag certificates from publicly-trusted CAs that are issued to intranet
   // hosts. While the CA/Browser Forum Baseline Requirements (v1.1) permit
@@ skipping 257 matching lines @@
     return true;
 
   return false;
 }
 
 // static
 const base::Feature CertVerifyProc::kSHA1LegacyMode{
     "SHA1LegacyMode", base::FEATURE_DISABLED_BY_DEFAULT};
 
 }  // namespace net