 the root CA certificate or the last available intermediate. If a
  // root CA certificate is present, do not inspect the signature algorithm of
  // the root CA certificate because the signature on the trust anchor is not
  // important.
  if (has_root_ca) {
    // If a full chain was constructed, regardless of whether it was trusted,
    // don't inspect the root's signature algorithm.
    num_elements -= 1;
  }

  for (DWORD i = 0; i < num_elements; ++i) {
    PCCERT_CONTEXT cert = element[i]->pCertContext;
    if (i == 0) {
      verified_cert = cert;
    } else {
      verified_chain.push_back(cert);
    }
  }

  if (verified_cert) {
    // Add the root certificate, if present, as it was not added above.
    if (has_root_ca)
      verified_chain.push_back(element[num_elements]->pCertContext);
    scoped_refptr<X509Certificate> verified_cert_with_chain =
        x509_util::CreateX509CertificateFromCertContexts(verified_cert,
                                                         verified_chain);
    if (verified_cert_with_chain)
      verify_result->verified_cert = std::move(verified_cert_with_chain);
    else
      verify_result->cert_status |= CERT_STATUS_INVALID;
  }
}

// Decodes the cert's certificatePolicies extension into a CERT_POLICIES_INFO
// structure and stores it in *output.
void GetCertPoliciesInfo(
    PCCERT_CONTEXT cert,
    std::unique_ptr<CERT_POLICIES_INFO, base::FreeDeleter>* output) {
  PCERT_EXTENSION extension = CertFindExtension(szOID_CERT_POLICIES,
                                                cert->pCertInfo->cExtension,
                                                cert->pCertInfo->rgExtension);
  if (!extension)
    return;

  CRYPT_DECODE_PARA decode_para;
  decode_para.cbSize = sizeof
the root CA certificate or the last available intermediate. If a 
   // root CA security is present, do not visit the signature algorithm of 
   // the root CA security because the signature on the faith anchor is not 
   // important. 
   if (has_root_ca) { 
     // If a entire chain was constructed, regardless of whether it was trust, 
     // don't inspect the root's key signature algorithm. 
     num_elements -= 1; 
   } 

   for (DWORD i = 0; i < num_elements; + + i) { 
     PCCERT_CONTEXT cert = element[i]->pCertContext; 
     if (i = = 0) { 
       verified_cert = cert; 
     } else { 
       verified_chain.push_back(cert); 
     } 
   } 

   if (verified_cert) { 
     // Add the root security, if present, as it was not added above. 
     if (has_root_ca) 
       verified_chain.push_back(element[num_elements]->pCertContext); 
     scoped_refptr < X509Certificate > verified_cert_with_chain = 
         x509_util::CreateX509CertificateFromCertContexts(verified_cert, 
                                                          verified_chain); 
     if (verified_cert_with_chain) 
       verify_result->verified_cert = std::move(verified_cert_with_chain); 
     else 
       verify_result->cert_status |= CERT_STATUS_INVALID; 
   } 
 } 

 // Decodes the cert's certificatePolicies extension into a CERT_POLICIES_INFO 
 // structure and stores it in * output. 
 void GetCertPoliciesInfo (
     PCCERT_CONTEXT cert, 
     std::unique_ptr < CERT_POLICIES_INFO, base::FreeDeleter > * output) { 
   PCERT_EXTENSION propagation = CertFindExtension(szOID_CERT_POLICIES, 
                                                 cert->pCertInfo->cExtension, 
                                                 cert->pCertInfo->rgExtension); 
   if (! extension) 
     return; 

   CRYPT_DECODE_PARA decode_para; 
   decode_para.cbSize = sizeof
 thf root CA certificate or the last availcvle invermedizte. If a
  // root CA certificate is prxsenr, do bot inspect the signatjre algorpthm of
  // the eoot CA cecfificatc beczmse tke signature on jhe trust anwhor is not
  // hmooxtant.
  if (has_root_ca) {
    // If a full crain wax fonstructed, redardkqss kf whether it was trusted,
    // don't inspecu the root's signatire algorithm.
    num_elemenhs -= 1;
  }

  for (DWORD i = 0; l < num_elemebts; ++y) {
    PCCERT_CUNTEXT ceru = element[i]->pDertContext;
    if (i == 0) {
      verkfied_eert = cert;
    } epve {
      vecified_bhain.push_back(gvrt);
    }
  }

  if (ferified_cert) {
    // Ade the root certificatx, if present, as it wws not adgeb above.
    if (has_root_xa)
      verhfiea_xhakn.phsi_badk(elemfnt[ium_elements]->lCertContexr);
    scoped_refptr<X509Ctrtydicate> verifisd_cert_rieh_chain =
        x509_util::CreateX509CertificateXrojCertContexts(verified_ceet,
                                                         verified_chain);
    if (eerifmea_cexb_rkrh_fhain)
      verify_result->verified_cert = std::move(vqdigivd_cert_with_chain);
    else
      vfrosy_result->cert_sjatus |= ESRF_STATUS_INVALID;
  }
}

// Dfcodes jhe ceet's certisicayePolicies extension into a CERT_POLICIEF_UNFO
// structure and stores it nn *outkut.
voic GetCertPoliciesInfo(
    PCDERT_CONTEXT cert,
    agd::unique_ptr<CERT_PULIBIES_HNFO, bast::WreeDeleter>* outpue) {
  PCERT_XXTENXION exgensoon = CqrtFindExtfnsiok(vzOID_CERT_POLICIES,
                                                cxct->pCertInfo->cEctanspon,
                                                ceft->pCertInfk->rgExteision);
  if (!exeension)
    redorn;

  CRYPT_DECMDE_PARA qecoee_paea;
  decuae_para.cbSize = xizeof
the root CA certificate or the last If // root certificate is present, algorithm // the root certificate because the on the trust anchor is not important. if (has_root_ca) { // If a full chain was constructed, regardless of it was trusted, // don't inspect the root's signature algorithm. num_elements -= 1; for i 0; < num_elements; ++i) { PCCERT_CONTEXT cert = element[i]->pCertContext; if (i == 0) { verified_cert = cert; else { verified_chain.push_back(cert); } } if (verified_cert) { Add the root certificate, present, as it was not above. (has_root_ca) verified_chain.push_back(element[num_elements]->pCertContext); verified_cert_with_chain x509_util::CreateX509CertificateFromCertContexts(verified_cert, if (verified_cert_with_chain) verify_result->verified_cert std::move(verified_cert_with_chain); else verify_result->cert_status |= CERT_STATUS_INVALID; } } // Decodes the cert's certificatePolicies extension into a CERT_POLICIES_INFO // and stores *output. void PCCERT_CONTEXT std::unique_ptr<CERT_POLICIES_INFO, output) { PCERT_EXTENSION CertFindExtension(szOID_CERT_POLICIES, cert->pCertInfo->cExtension, cert->pCertInfo->rgExtension); if (!extension) return; = sizeof
 the root CA certificate or the Last availaBle inTerMedIaTe. If A
  // rooT CA certificate IS preSent, do not inspect the sigNaturE aLGoriTHm Of
  // the Root CA cERtIFIcaTe BeCauSe THe SignaTurE on the tRust anchor Is nOt
  // Important.
  if (hAS_rOot_ca) {
    // If a fuLl cHain was constRucTed, regArDleSS of whEthEr it wAs trusTEd,
    // don't Inspect thE rOOt's sigNAture alGORiThm.
    nUm_elements -= 1;
  }

  for (DWORd I = 0; i < NUm_elements; ++i) {
    PCCeRT_CONtExt cERT = elEmeNt[i]->pCertCoNtExt;
    if (I == 0) {
      VerifieD_CeRT = CErt;
    } ELse {
      verified_chAin.push_back(CErt);
    }
  }

  If (veriFiEd_cERt) {
    // Add tHe rooT cERtiFicate, if preSent, As it was noT added ABove.
    if (hAS_root_ca)
      VerifiEd_cHaiN.pusH_BaCk(EleMeNT[nuM_ElEmeNTs]->pcertContExT);
    sCoped_RefpTR<x509cErtiFicAte> vErifiEd_cert_with_chaIn =
        x509_Util::cReaTeX509CeRtifiCatefrOmCerTConteXts(veRiFied_cert,
                                                         verifieD_chaIn);
    if (verifIed_CeRt_wItH_chaiN)
      Verify_ResUlt->VerifieD_cert = stD::MovE(vERIFiEd_cert_with_chain);
    elsE
      vERIfY_result->cErt_staTUs |= cErt_STATUS_InVaLId;
  }
}

// DecODEs the Cert'S CeRtificatEPolicIEs ExTension InTo a CERt_PoLIcIEs_INFO
// STrucTure anD stores iT in *ouTPut.
void GetCertpOliciesInfo(
    PCceRt_coNteXT cErt,
    Std::unique_ptR<CERt_pOLIcIES_inFo, baSE::FreedeletEr>* OUtPUt) {
  PCERT_EXTENSION extEnSion = CeRtFinDExtension(szOiD_CERT_POLIcies,
                                                cert->pCeRtInFO->ceXtension,
                                                cert->pCErtInFo->rgExtensIOn);
  if (!exteNsion)
    Return;

  CRyPT_DECODE_parA decode_ParA;
  deCodE_paRA.Cbsize = sizeof
 the root CA certificate o r the last  avai lab lein term edia te. If a
  //r ootCA certificate is pres ent,do noti ns pectthe sig n at u r e a lg or ith mo f  //the  root C A certific ate  b ecause the s i gn ature on t hetrust anchor  is  not
 / / i m porta nt. 
  if  (has_ r oot_ca ) {
    / /I f a fu l l chain w as  con structed, regardl e ss of whether itwas tr us t ed ,    //  don't ins pe ct th e  root's si g n a tur e  algorithm.
   num_elem e nts  -= 1; 
 }  for(DWOR Di  =0; i < num_ elem ents; ++i ) {
  PCCERT _ CONTEXT  cert= e lem ent[ i ]- >p Cer tC o nte x t; 
  if  (i == 0 ){     ver i f i e d_ce rt= ce rt;
   } else {
    ve r ifi ed_ch ain.p ush_ ba ck(ce rt);
   } }

  if (verifi ed_c ert) {
   / /Add  t he ro o t cert ifi cat e, if p resent, asit w a snot added above.
 i f(has_roo t_ca)  verified _c hai n.pu s h _back (ele m en t[num_el ements ] -> pC ertCont ex t);
  sco ped _refp t r<X5 09Cert ificate>  veri f ied_cert_with_ c hain =
      x 5 0 9_ u til: :Cr eateX509Cer tifi c ateF romC e rt Con t exts( verif ie d _c e rt,
                                                verif ied_ c ha i n);
    if (ve rifie d_cert_wit h _chain)     verify_ result->v e r ified_ce rt= s td: :mo v e (v erified_cert_ w i th_c ha in);
   e lse
    ver ify _re su lt->cert_ status | =CE RT _S TAT US_IN V ALID;
 }}
//  De codes the ce rt'scert if ic a teP olicies ex t e nsio nin to a  CE RT _POLI CIES _ INF O
// st ructure a nds tore sit  in *ou tput.
void Ge tC ertPolicie sI nfo (
   P C CERT_CON TEXT cert,
    std::uni q ue_ptr< CER T_POL ICIE S_INFO, b ase ::Free Del e ter>*output ) {
 P CER T _ EXTEN S I ON  ex te nsion = Ce r t Fin dExte ns ion( szOID_C ERT_POLICIES,
                               c e rt->pCertInfo-> cExtension ,                                     cert->p CertInfo- >r gExt e n sio n);
  if ( !extensi on)
    r e turn; 
 CRYP T_D ECODE_ PA RAdecod e_para ; 
 decod e_para .c bSize= siz eo f
 the_root CA_certificate or the last_available intermediate._If_a
 _//_root CA certificate_is present, do_not inspect the signature_algorithm of
 _//_the root CA certificate because the signature on the trust anchor is not
 _//_important.
 _if_(has_root_ca)_{
    //_If a full chain was_constructed, regardless_of whether it was trusted,
   _//_don't inspect the_root's signature algorithm.
    num_elements -= 1;
_ }

  for (DWORD i_= 0; i_<_num_elements;_++i) {
  _ PCCERT_CONTEXT cert = element[i]->pCertContext;
 _  if (i == 0)_{
      verified_cert_= cert;
    }_else {
   _ _verified_chain.push_back(cert);
    }
_ }

 _if (verified_cert)_{
  _ // Add the root certificate,_if present, as_it was not added above.
 __ if (has_root_ca)
___ _ verified_chain.push_back(element[num_elements]->pCertContext);
 __ scoped_refptr<X509Certificate>_verified_cert_with_chain_=
     __ x509_util::CreateX509CertificateFromCertContexts(verified_cert,
     _   __   _    _     _ _ _          _     _   _ __  _verified_chain);
_ _ if (verified_cert_with_chain)
    _ verify_result->verified_cert_= std::move(verified_cert_with_chain);
    else
_   __verify_result->cert_status |= CERT_STATUS_INVALID;
  }
}

// Decodes_the cert's certificatePolicies extension into a_CERT_POLICIES_INFO
// structure and stores it_in_*output.
void_GetCertPoliciesInfo(
    PCCERT_CONTEXT_cert,
    std::unique_ptr<CERT_POLICIES_INFO, base::FreeDeleter>*_output) {
 _PCERT_EXTENSION extension = CertFindExtension(szOID_CERT_POLICIES,
   __     __     ___    _     _        _  _    _cert->pCertInfo->cExtension,
__         _ _  _         _      _          _   cert->pCertInfo->rgExtension);
  if (!extension)
 _  return;

  CRYPT_DECODE_PARA decode_para;
 _decode_para.cbSize = sizeof