Check X509Certificate::CreateFromHandle result.

net/ssl/client_cert_store_nss.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/ssl/client_cert_store_nss.h"
 
 #include <nss.h>
 #include <ssl.h>
 
 #include <algorithm>
@@ skipping 81 matching lines @@
     X509Certificate::OSCertHandles intermediates_raw;
     for (const auto& intermediate : intermediates) {
       intermediates_raw.push_back(intermediate.get());
     }
 
     // Retain a copy of the intermediates. Some deployments expect the client to
     // supply intermediates out of the local store. See
     // https://crbug.com/548631.
     filtered_certs->push_back(
         X509Certificate::CreateFromHandle(handle, intermediates_raw));
+    // |handle| was successfully parsed by |cert|, so this should never fail.
+    DCHECK(filtered_certs->back());
   }
   DVLOG(2) << "num_raw:" << num_raw
            << " num_filtered:" << filtered_certs->size();
 
   std::sort(filtered_certs->begin(), filtered_certs->end(),
             x509_util::ClientCertSorter());
 }
 
 void ClientCertStoreNSS::GetAndFilterCertsOnWorkerThread(
     std::unique_ptr<crypto::CryptoModuleBlockingPasswordDelegate>
@@ skipping 12 matching lines @@
     net::CertificateList* certs) {
   CERTCertList* found_certs =
       CERT_FindUserCertsByUsage(CERT_GetDefaultCertDB(), certUsageSSLClient,
                                 PR_FALSE, PR_FALSE, password_delegate.get());
   if (!found_certs) {
     DVLOG(2) << "No client certs found.";
     return;
   }
   for (CERTCertListNode* node = CERT_LIST_HEAD(found_certs);
        !CERT_LIST_END(node, found_certs); node = CERT_LIST_NEXT(node)) {
-    certs->push_back(X509Certificate::CreateFromHandle(
-        node->cert, X509Certificate::OSCertHandles()));
+    scoped_refptr<X509Certificate> cert = X509Certificate::CreateFromHandle(
+        node->cert, X509Certificate::OSCertHandles());
+    if (!cert) {
+      DVLOG(2) << "X509Certificate::CreateFromHandle failed";
+      continue;
+    }
+    certs->push_back(cert);

[eroman, 2017/03/22 22:17:52]

std::move ?

[mattm, 2017/03/23 22:59:03]

Done.

   }
   CERT_DestroyCertList(found_certs);
 }
 
 }  // namespace net