Check X509Certificate::CreateFromHandle result.

net/cert/cert_verify_proc_openssl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/cert_verify_proc_openssl.h"
 
 #include <string>
 #include <vector>
 
 #include "base/logging.h"
@@ skipping 91 matching lines @@
     if (i == 0) {
       verified_cert = cert;
     } else {
       verified_chain.push_back(cert);
     }
   }
 
   // Set verify_result->verified_cert and
   // verify_result->is_issued_by_known_root.
   if (verified_cert) {
-    verify_result->verified_cert =
+    scoped_refptr<X509Certificate> verified_cert_with_chain =
         X509Certificate::CreateFromHandle(verified_cert, verified_chain);
+    if (!verified_cert_with_chain)
+      return false;
+    verify_result->verified_cert = std::move(verified_cert_with_chain);
 
     // For OpenSSL builds, only certificates used for unit tests are treated
     // as not issued by known roots. The only way to determine whether a
     // certificate is issued by a known root using OpenSSL is to examine
     // distro-and-release specific hardcoded lists.
     verify_result->is_issued_by_known_root = true;
     if (TestRootCerts::HasInstance()) {
       X509* root = NULL;
       if (verified_chain.empty()) {
         root = verified_cert;
       } else {
         root = verified_chain.back();
       }
       TestRootCerts* root_certs = TestRootCerts::GetInstance();
       if (root_certs->Contains(root))
           verify_result->is_issued_by_known_root = false;
     }
   }
+  return true;
 }
 
 void AppendPublicKeyHashes(X509_STORE_CTX* store_ctx,
                            HashValueVector* hashes) {
   STACK_OF(X509)* chain = X509_STORE_CTX_get_chain(store_ctx);
   for (size_t i = 0; i < sk_X509_num(chain); ++i) {
     X509* cert = sk_X509_value(chain, i);
 
     std::string der_data;
     if (!X509Certificate::GetDEREncoded(cert, &der_data))
@@ skipping 63 matching lines @@
     int x509_error = X509_STORE_CTX_get_error(ctx.get());
     CertStatus cert_status = MapCertErrorToCertStatus(x509_error);
     LOG(ERROR) << "X509 Verification error "
         << X509_verify_cert_error_string(x509_error)
         << " : " << x509_error
         << " : " << X509_STORE_CTX_get_error_depth(ctx.get())
         << " : " << cert_status;
     verify_result->cert_status |= cert_status;
   }
 
-  GetCertChainInfo(ctx.get(), verify_result);
+  if (!GetCertChainInfo(ctx.get(), verify_result))
+    verify_result->cert_status |= CERT_STATUS_INVALID;
   AppendPublicKeyHashes(ctx.get(), &verify_result->public_key_hashes);
 
   if (IsCertStatusError(verify_result->cert_status))
     return MapCertStatusToNetError(verify_result->cert_status);
 
   return OK;
 }
 
 }  // namespace net