Check X509Certificate::CreateFromHandle result.

net/third_party/mozilla_security_manager/nsPKCS12Blob.cpp

 /* ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
  * The contents of this file are subject to the Mozilla Public License Version
  * 1.1 (the "License"); you may not use this file except in compliance with
  * the License. You may obtain a copy of the License at
  * http://www.mozilla.org/MPL/
  *
  * Software distributed under the License is distributed on an "AS IS" basis,
  * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
@@ skipping 207 matching lines @@
     if (!cert) {
       LOG(ERROR) << "Could not grab a handle to the certificate in the slot "
                  << "from the corresponding PKCS#12 DER certificate.";
       continue;
     }
 
     // Add the cert to the list
     if (imported_certs) {
       // Empty list of intermediates.
       net::X509Certificate::OSCertHandles intermediates;
-      imported_certs->push_back(
-          net::X509Certificate::CreateFromHandle(cert, intermediates));
+      scoped_refptr<net::X509Certificate> x509_cert =
+          net::X509Certificate::CreateFromHandle(cert, intermediates);
+      if (x509_cert)
+        imported_certs->push_back(x509_cert);

[eroman, 2017/03/22 22:17:52]

move?

[mattm, 2017/03/23 22:59:03]

Done.

     }
 
     // Once we have determined that the imported certificate has an
     // associated private key too, only then can we mark the key as
     // non-extractable.
     if (!decoder_item->hasKey) {
       CERT_DestroyCertificate(cert);
       continue;
     }
 
@@ skipping 241 matching lines @@
 finish:
   if (srv)
     LOG(ERROR) << "PKCS#12 export failed with error " << PORT_GetError();
   if (ecx)
     SEC_PKCS12DestroyExportContext(ecx);
   SECITEM_ZfreeItem(&unicodePw, PR_FALSE);
   return return_count;
 }
 
 }  // namespace mozilla_security_manager