Reject certificates that contain unknown policy qualifiers if the

net/cert/internal/parsed_certificate.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/internal/parsed_certificate.h"
 
 #include "net/cert/internal/certificate_policies.h"
 #include "net/cert/internal/extended_key_usage.h"
 #include "net/cert/internal/name_constraints.h"
 #include "net/cert/internal/signature_algorithm.h"
@@ skipping 171 matching lines @@
       result->has_authority_info_access_ = true;
       if (!ParseAuthorityInfoAccess(
               result->authority_info_access_extension_.value,
               &result->ca_issuers_uris_, &result->ocsp_uris_))
         return nullptr;
     }
 
     // Policies.
     if (result->GetExtension(CertificatePoliciesOid(), &extension)) {
       result->has_policy_oids_ = true;
-      if (!ParseCertificatePoliciesExtension(extension.value,
-                                             &result->policy_oids_)) {
+      if (!ParseCertificatePoliciesExtension(
+              extension.value, false /*fail_parsing_unknown_qualifier_oids*/,
+              &result->policy_oids_)) {
         return nullptr;
       }
     }
 
     // Policy constraints.
     if (result->GetExtension(PolicyConstraintsOid(), &extension)) {
       result->has_policy_constraints_ = true;
       if (!ParsePolicyConstraints(extension.value,
                                   &result->policy_constraints_)) {
         return nullptr;
@@ skipping 15 matching lines @@
                                  &result->inhibit_any_policy_)) {
         return nullptr;
       }
     }
   }
 
   return result;
 }
 
 }  // namespace net