Stop leaking a CERTCertificate* during SSL renegotiation

net/socket/ssl_client_socket_nss.cc

Index: net/socket/ssl_client_socket_nss.cc
diff --git a/net/socket/ssl_client_socket_nss.cc b/net/socket/ssl_client_socket_nss.cc
index 343bd204eabb85d42782be965e56dde4e0ff09ce..6617dab378068b8ce1778cec285bc8c4eb12e146 100644
--- a/net/socket/ssl_client_socket_nss.cc
+++ b/net/socket/ssl_client_socket_nss.cc
@@ -1283,7 +1283,7 @@ SECStatus SSLClientSocketNSS::Core::OwnAuthCertHandler(
   } else {
     // Disallow the server certificate to change in a renegotiation.
     CERTCertificate* old_cert = core->nss_handshake_state_.server_cert_chain[0];
-    CERTCertificate* new_cert = SSL_PeerCertificate(socket);
+    ScopedCERTCertificate new_cert(SSL_PeerCertificate(socket));
     if (new_cert->derCert.len != old_cert->derCert.len ||
         memcmp(new_cert->derCert.data, old_cert->derCert.data,
                new_cert->derCert.len) != 0) {