Update from https://crrev.com/312398

net/http/http_security_headers.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/base64.h"
 #include "base/basictypes.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_tokenizer.h"
 #include "base/strings/string_util.h"
 #include "net/http/http_security_headers.h"
 #include "net/http/http_util.h"
 
 namespace net {
 
 namespace {
 
-COMPILE_ASSERT(kMaxHSTSAgeSecs <= kuint32max, kMaxHSTSAgeSecsTooLarge);
+static_assert(kMaxHSTSAgeSecs <= kuint32max, "kMaxHSTSAgeSecs too large");
 
 // MaxAgeToInt converts a string representation of a "whole number" of
 // seconds into a uint32. The string may contain an arbitrarily large number,
 // which will be clipped to kMaxHSTSAgeSecs and which is guaranteed to fit
 // within a 32-bit unsigned integer. False is returned on any parse error.
 bool MaxAgeToInt(std::string::const_iterator begin,
                  std::string::const_iterator end,
                  uint32* result) {
   const std::string s(begin, end);
   int64 i = 0;
@@ skipping 83 matching lines @@
   pair.first = source.substr(0, point);
   if (std::string::npos != point)
     pair.second = source.substr(point + 1);
 
   return pair;
 }
 
 bool ParseAndAppendPin(const std::string& value,
                        HashValueTag tag,
                        HashValueVector* hashes) {
+  // Pins are always quoted.
+  if (value.empty() || !HttpUtil::IsQuote(value[0]))
+    return false;
+
   std::string unquoted = HttpUtil::Unquote(value);
-  std::string decoded;
-
   if (unquoted.empty())
       return false;
 
+  std::string decoded;
   if (!base::Base64Decode(unquoted, &decoded))
     return false;
 
   HashValue hash(tag);
   if (decoded.size() != hash.size())
     return false;
 
   memcpy(hash.data(), decoded.data(), hash.size());
   hashes->push_back(hash);
   return true;
@@ skipping 179 matching lines @@
   }
 
   if (!parsed_max_age)
     return false;
 
   if (!IsPinListValid(pins, chain_hashes))
     return false;
 
   *max_age = base::TimeDelta::FromSeconds(max_age_candidate);
   *include_subdomains = include_subdomains_candidate;
-  for (HashValueVector::const_iterator i = pins.begin();
-       i != pins.end(); ++i) {
-    bool found = false;
-
-    for (HashValueVector::const_iterator j = hashes->begin();
-         j != hashes->end(); ++j) {
-      if (j->Equals(*i)) {
-        found = true;
-        break;
-      }
-    }
-
-    if (!found)
-      hashes->push_back(*i);
-  }
+  hashes->swap(pins);
 
   return true;
 }
 
 }  // namespace net