Fix potential UAF in DriveAppConverter.

chrome/browser/apps/drive/drive_app_converter.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/apps/drive/drive_app_converter.h"
 
 #include <algorithm>
 #include <set>
 
+#include "base/callback_helpers.h"
 #include "base/logging.h"
 #include "base/memory/ref_counted.h"
 #include "base/strings/utf_string_conversions.h"
 #include "chrome/browser/extensions/crx_installer.h"
 #include "chrome/browser/extensions/install_tracker.h"
 #include "chrome/browser/image_decoder.h"
 #include "chrome/browser/profiles/profile.h"
 #include "content/public/browser/browser_thread.h"
 #include "extensions/browser/extension_system.h"
 #include "extensions/common/constants.h"
@@ skipping 83 matching lines @@
 
 DriveAppConverter::~DriveAppConverter() {
   PostInstallCleanUp();
 }
 
 void DriveAppConverter::Start() {
   DCHECK(!IsStarted());
 
   if (drive_app_info_.app_name.empty() ||
       !drive_app_info_.create_url.is_valid()) {
     finished_callback_.Run(this, false);

[benwells, 2015/04/27 22:22:10]

Its also called here. Should this one be updated too?

TBH I don't really get the point of this change. Is the fear that |this| will be
referenced in the callback (DriveAppProvider::OnLocalAppConverted) after it is
freed? It doesn't appear like that is the case currently. Further, if
DriveAppProvider::OnLocalAppConverted was changed to use |converter| after the
pending coverter is erased (and thus destroyed), this change won't help.

Maybe someone can explain to me what I'm missing?

[xiyuan, 2015/04/27 22:54:14]

Good catch. This should be updated too.
My understanding is that the worry is callback might have stored bound arguments
which might be referenced after Callback::Run invokes the real function and
causes UAF. I don't know excatly how this could happen either. Maybe pneubeck@
can elaborate?

     return;
   }
 
   web_app_.title = base::UTF8ToUTF16(drive_app_info_.app_name);
   web_app_.app_url = drive_app_info_.create_url;
 
   const std::set<int> allowed_sizes(extension_misc::kExtensionIconSizes,
                                     extension_misc::kExtensionIconSizes +
                                         extension_misc::kNumExtensionIconSizes);
   std::set<int> pending_sizes;
@@ skipping 67 matching lines @@
                                            bool success) {
   if (!crx_installer_->extension() ||
       crx_installer_->extension()->id() != extension_id) {
     return;
   }
 
   extension_ = crx_installer_->extension();
   is_new_install_ = success && crx_installer_->current_version().empty();
   PostInstallCleanUp();
 
-  finished_callback_.Run(this, success);
+  base::ResetAndReturn(&finished_callback_).Run(this, success);
   // |finished_callback_| could delete this.
 }