net: don't duplicate HPKP hashes when parsing the header.

net/http/http_security_headers.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/base64.h"
 #include "base/basictypes.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_tokenizer.h"
 #include "base/strings/string_util.h"
 #include "net/http/http_security_headers.h"
@@ skipping 307 matching lines @@
   if (!parsed_max_age)
     return false;
 
   if (!IsPinListValid(pins, chain_hashes))
     return false;
 
   *max_age = base::TimeDelta::FromSeconds(max_age_candidate);
   *include_subdomains = include_subdomains_candidate;
   for (HashValueVector::const_iterator i = pins.begin();
        i != pins.end(); ++i) {
-    hashes->push_back(*i);
+    bool found = false;
+
+    for (HashValueVector::const_iterator j = hashes->begin();
+         j != hashes->end(); ++j) {
+      if (j->Equals(*i)) {
+        found = true;
+        break;
+      }
+    }
+
+    if (!found)
+      hashes->push_back(*i);
   }
 
   return true;
 }
 
 }  // namespace net