Improve CertVerifyProcOpenSSL robustness against malicious data

net/base/cert_verify_proc_openssl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/cert_verify_proc_openssl.h"
 
 #include <openssl/x509v3.h>
 
 #include <string>
 #include <vector>
@@ skipping 170 matching lines @@
   if (!intermediates.get())
     return ERR_OUT_OF_MEMORY;
 
   const X509Certificate::OSCertHandles& os_intermediates =
       cert->GetIntermediateCertificates();
   for (X509Certificate::OSCertHandles::const_iterator it =
        os_intermediates.begin(); it != os_intermediates.end(); ++it) {
     if (!sk_X509_push(intermediates.get(), *it))
       return ERR_OUT_OF_MEMORY;
   }
-  int rv = X509_STORE_CTX_init(ctx.get(), X509Certificate::cert_store(),
-                               cert->os_cert_handle(), intermediates.get());
-  CHECK_EQ(1, rv);
+  if (X509_STORE_CTX_init(ctx.get(), X509Certificate::cert_store(),
+                          cert->os_cert_handle(), intermediates.get()) != 1) {
+    NOTREACHED();
+    return ERR_FAILED;
+  }
 
   if (X509_verify_cert(ctx.get()) != 1) {
     int x509_error = X509_STORE_CTX_get_error(ctx.get());
     CertStatus cert_status = MapCertErrorToCertStatus(x509_error);
     LOG(ERROR) << "X509 Verification error "
         << X509_verify_cert_error_string(x509_error)
         << " : " << x509_error
         << " : " << X509_STORE_CTX_get_error_depth(ctx.get())
         << " : " << cert_status;
     verify_result->cert_status |= cert_status;
   }
 
   GetCertChainInfo(ctx.get(), verify_result);
   AppendPublicKeyHashes(ctx.get(), &verify_result->public_key_hashes);
   if (IsCertStatusError(verify_result->cert_status))
     return MapCertStatusToNetError(verify_result->cert_status);
 
   // Currently we only ues OpenSSL's default root CA paths, so treat all
   // correctly verified certs as being from a known root.
   // TODO(joth): if the motivations described in
   // http://src.chromium.org/viewvc/chrome?view=rev&revision=80778 become an
   // issue on OpenSSL builds, we will need to embed a hardcoded list of well
   // known root CAs, as per the _mac and _win versions.
   verify_result->is_issued_by_known_root = true;
 
   return OK;
 }
 
 }  // namespace net