Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(17)

Side by Side Diff: net/disk_cache/sparse_control.cc

Issue 10828025: Added sanity check for entry in SparseControl::DeleteChildren (Closed) Base URL: svn://svn.chromium.org/chrome/trunk/src
Patch Set: Created 8 years, 4 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch | Annotate | Revision Log
« no previous file with comments | « no previous file | no next file » | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include "net/disk_cache/sparse_control.h" 5 #include "net/disk_cache/sparse_control.h"
6 6
7 #include "base/bind.h" 7 #include "base/bind.h"
8 #include "base/format_macros.h" 8 #include "base/format_macros.h"
9 #include "base/logging.h" 9 #include "base/logging.h"
10 #include "base/message_loop.h" 10 #include "base/message_loop.h"
(...skipping 314 matching lines...) Expand 10 before | Expand all | Expand 10 after
325 // We'll grab another reference to keep this object alive because we just have 325 // We'll grab another reference to keep this object alive because we just have
326 // one extra reference due to the pending IO operation itself, but we'll 326 // one extra reference due to the pending IO operation itself, but we'll
327 // release that one before invoking user_callback_. 327 // release that one before invoking user_callback_.
328 entry_->AddRef(); // Balanced in DoAbortCallbacks. 328 entry_->AddRef(); // Balanced in DoAbortCallbacks.
329 abort_callbacks_.push_back(callback); 329 abort_callbacks_.push_back(callback);
330 return net::ERR_IO_PENDING; 330 return net::ERR_IO_PENDING;
331 } 331 }
332 332
333 // Static 333 // Static
334 void SparseControl::DeleteChildren(EntryImpl* entry) { 334 void SparseControl::DeleteChildren(EntryImpl* entry) {
335 DCHECK(entry);
rvargas (doing something else) 2012/07/26 00:03:14 Actually, removing the DCHECK makes more sense. We
335 DCHECK(entry->GetEntryFlags() & PARENT_ENTRY); 336 DCHECK(entry->GetEntryFlags() & PARENT_ENTRY);
336 int data_len = entry->GetDataSize(kSparseIndex); 337 int data_len = entry->GetDataSize(kSparseIndex);
337 if (data_len < static_cast<int>(sizeof(SparseData)) || 338 if (data_len < static_cast<int>(sizeof(SparseData)) ||
338 entry->GetDataSize(kSparseData)) 339 entry->GetDataSize(kSparseData))
339 return; 340 return;
340 341
341 int map_len = data_len - sizeof(SparseHeader); 342 int map_len = data_len - sizeof(SparseHeader);
342 if (map_len > kMaxMapSize || map_len % 4) 343 if (map_len > kMaxMapSize || map_len % 4)
343 return; 344 return;
344 345
345 char* buffer; 346 char* buffer;
346 Addr address; 347 Addr address;
347 entry->GetData(kSparseIndex, &buffer, &address); 348 entry->GetData(kSparseIndex, &buffer, &address);
348 if (!buffer && !address.is_initialized()) 349 if (!buffer && !address.is_initialized())
349 return; 350 return;
350 351
351 entry->net_log().AddEvent(net::NetLog::TYPE_SPARSE_DELETE_CHILDREN); 352 entry->net_log().AddEvent(net::NetLog::TYPE_SPARSE_DELETE_CHILDREN);
352 353
353 DCHECK(entry && entry->backend_); 354 DCHECK(entry->backend_);
354 ChildrenDeleter* deleter = new ChildrenDeleter(entry->backend_, 355 ChildrenDeleter* deleter = new ChildrenDeleter(entry->backend_,
355 entry->GetKey()); 356 entry->GetKey());
356 // The object will self destruct when finished. 357 // The object will self destruct when finished.
357 deleter->AddRef(); 358 deleter->AddRef();
358 359
359 if (buffer) { 360 if (buffer) {
360 MessageLoop::current()->PostTask(FROM_HERE, base::Bind( 361 MessageLoop::current()->PostTask(FROM_HERE, base::Bind(
361 &ChildrenDeleter::Start, deleter, buffer, data_len)); 362 &ChildrenDeleter::Start, deleter, buffer, data_len));
362 } else { 363 } else {
363 MessageLoop::current()->PostTask(FROM_HERE, base::Bind( 364 MessageLoop::current()->PostTask(FROM_HERE, base::Bind(
(...skipping 511 matching lines...) Expand 10 before | Expand all | Expand 10 after
875 CompletionCallback cb = abort_callbacks_[i]; 876 CompletionCallback cb = abort_callbacks_[i];
876 if (i == abort_callbacks_.size() - 1) 877 if (i == abort_callbacks_.size() - 1)
877 abort_callbacks_.clear(); 878 abort_callbacks_.clear();
878 879
879 entry_->Release(); // Don't touch object after this line. 880 entry_->Release(); // Don't touch object after this line.
880 cb.Run(net::OK); 881 cb.Run(net::OK);
881 } 882 }
882 } 883 }
883 884
884 } // namespace disk_cache 885 } // namespace disk_cache
OLDNEW
« no previous file with comments | « no previous file | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698