Add tests for certificates that pass X509CertificateBytes parsing, but fail in CertVerifyProc. Fix …

net/cert/cert_verify_proc_mac.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/cert_verify_proc_mac.h"
 
 #include <CommonCrypto/CommonDigest.h>
 #include <CoreServices/CoreServices.h>
 #include <Security/Security.h>
 
@@ skipping 724 matching lines @@
           &keychain);
       if (status)
         return NetErrorFromOSStatus(status);
       ScopedCFTypeRef<SecKeychainRef> scoped_keychain(keychain);
 
       CFArrayInsertValueAtIndex(mutable_keychain_search_list, 0, keychain);
     }
 
     ScopedCFTypeRef<CFMutableArrayRef> cert_array(
         x509_util::CreateSecCertificateArrayForX509Certificate(cert));
-    if (!cert_array)
+    if (!cert_array) {
+      verify_result->cert_status |= CERT_STATUS_INVALID;

[mattm, 2017/05/16 22:46:26]

note: Need to set status here or later checks in CertVerifyProc::Verify can
override the return code (eg, common_name check).

       return ERR_CERT_INVALID;
+    }
 
     // Beginning with the certificate chain as supplied by the server, attempt
     // to verify the chain. If a failure is encountered, trim a certificate
     // from the end (so long as one remains) and retry, in the hope of forcing
     // OS X to find a better path.
     while (CFArrayGetCount(cert_array) > 0) {
       ScopedCFTypeRef<SecTrustRef> temp_ref;
       SecTrustResultType temp_trust_result = kSecTrustResultDeny;
       ScopedCFTypeRef<CFArrayRef> temp_chain;
       CSSM_TP_APPLE_EVIDENCE_INFO* temp_chain_info = NULL;
@@ skipping 281 matching lines @@
     // EV cert and it was covered by CRLSets or revocation checking passed.
     verify_result->cert_status |= CERT_STATUS_IS_EV;
   }
 
   return OK;
 }
 
 }  // namespace net
 
 #pragma clang diagnostic pop  // "-Wdeprecated-declarations"