Add tests for certificates that pass X509CertificateBytes parsing, but fail in CertVerifyProc. Fix …

net/cert/cert_verify_proc_mac.cc

Index: net/cert/cert_verify_proc_mac.cc
diff --git a/net/cert/cert_verify_proc_mac.cc b/net/cert/cert_verify_proc_mac.cc
index 701587d3b2509d411e88b29e53407113864149f3..84cdfc43144ac5bc9ecc956deb1a28b0f2a82515 100644
--- a/net/cert/cert_verify_proc_mac.cc
+++ b/net/cert/cert_verify_proc_mac.cc
@@ -742,8 +742,10 @@ int VerifyWithGivenFlags(X509Certificate* cert,
 
     ScopedCFTypeRef<CFMutableArrayRef> cert_array(
         x509_util::CreateSecCertificateArrayForX509Certificate(cert));
-    if (!cert_array)
+    if (!cert_array) {
+      verify_result->cert_status |= CERT_STATUS_INVALID;

[mattm, 2017/05/16 22:46:26]

note: Need to set status here or later checks in CertVerifyProc::Verify can
override the return code (eg, common_name check).

       return ERR_CERT_INVALID;
+    }
 
     // Beginning with the certificate chain as supplied by the server, attempt
     // to verify the chain. If a failure is encountered, trim a certificate