Check X509Certificate::CreateFromHandle result.

net/ssl/client_cert_store_mac.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/ssl/client_cert_store_mac.h"
 
 #include <CommonCrypto/CommonDigest.h>
 #include <CoreFoundation/CFArray.h>
 #include <CoreServices/CoreServices.h>
 #include <Security/SecBase.h>
@@ skipping 96 matching lines @@
        i < chain_count; ++i) {
     SecCertificateRef cert = reinterpret_cast<SecCertificateRef>(
         const_cast<void*>(CFArrayGetValueAtIndex(cert_chain, i)));
     intermediates.push_back(cert);
   }
 
   scoped_refptr<X509Certificate> new_cert(X509Certificate::CreateFromHandle(
       cert_handle, intermediates));
   CFRelease(cert_chain);  // Also frees |intermediates|.
 
-  if (!new_cert->IsIssuedByEncoded(valid_issuers))
+  if (!new_cert || !new_cert->IsIssuedByEncoded(valid_issuers))
     return false;
 
   cert->swap(new_cert);
   return true;
 }
 
 // Returns true if |purpose| is listed as allowed in |usage|. This
 // function also considers the "Any" purpose. If the attribute is
 // present and empty, we return false.
 bool ExtendedKeyUsageAllows(const CE_ExtendedKeyUsage* usage,
@@ skipping 155 matching lines @@
 
     SecCertificateRef cert_handle;
     err = SecIdentityCopyCertificate(identity, &cert_handle);
     if (err != noErr)
       continue;
     ScopedCFTypeRef<SecCertificateRef> scoped_cert_handle(cert_handle);
 
     scoped_refptr<X509Certificate> cert(
         X509Certificate::CreateFromHandle(cert_handle,
                                           X509Certificate::OSCertHandles()));
+    if (!cert)
+      continue;
 
     if (preferred_identity && CFEqual(preferred_identity, identity)) {
       // Only one certificate should match.
       DCHECK(!preferred_cert.get());
       preferred_cert = cert;
     } else {
       regular_certs.push_back(cert);
     }
   }
 
@@ skipping 23 matching lines @@
     const SSLCertRequestInfo& request,
     CertificateList* selected_certs) {
   GetClientCertsImpl(
       preferred_cert, regular_certs, request, false, selected_certs);
   return true;
 }
 
 #pragma clang diagnostic pop  // "-Wdeprecated-declarations"
 
 }  // namespace net