[android_webview] Fix use after free in intercepted requests.

android_webview/browser/net/android_stream_reader_url_request_job.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef ANDROID_WEBVIEW_NATIVE_ANDROID_STREAM_READER_URL_REQUEST_JOB_H_
 #define ANDROID_WEBVIEW_NATIVE_ANDROID_STREAM_READER_URL_REQUEST_JOB_H_
 
 #include "base/android/scoped_java_ref.h"
 #include "base/location.h"
 #include "base/memory/scoped_ptr.h"
@@ skipping 61 matching lines @@
 
  protected:
   virtual ~AndroidStreamReaderURLRequestJob();
 
   // Gets the TaskRunner for the worker thread.
   // Overridden in unittests.
   virtual base::TaskRunner* GetWorkerThreadRunner();
 
   // Creates an InputStreamReader instance.
   // Overridden in unittests to return a mock.
-  virtual scoped_refptr<android_webview::InputStreamReader>
+  virtual scoped_ptr<android_webview::InputStreamReader>
       CreateStreamReader(android_webview::InputStream* stream);
 
  private:
+  // The requests posted to the worker thread might outlive the job.
+  // Thread-safe ref counting is used to ensure that the data is still there
+  // when the closure is run on the worker thread.
+  //
+  class InputStreamReaderWrapper :

[mnaganov (inactive), 2012/11/29 10:46:55]

If this class is only used by AndroidStreamReaderURLRequestJob, why not to
define it inside the .cc file?

[mkosiba (inactive), 2012/11/29 15:39:23]

I assumed scoped_refptr would complain that the type isn't defined, but I can
give it a shot.

+      public base::RefCountedThreadSafe<InputStreamReaderWrapper> {
+   public:
+    InputStreamReaderWrapper(
+        scoped_ptr<android_webview::InputStream> input_stream,
+        scoped_ptr<android_webview::InputStreamReader> input_stream_reader);
+
+    const android_webview::InputStream& input_stream() const {
+      return *input_stream_;
+    }
+
+    int Seek(const net::HttpByteRange& byte_range);
+    int ReadRawData(net::IOBuffer* buffer, int buffer_size);
+   private:
+    friend class base::RefCountedThreadSafe<InputStreamReaderWrapper>;
+    ~InputStreamReaderWrapper();
+
+    scoped_ptr<android_webview::InputStream> input_stream_;
+    scoped_ptr<android_webview::InputStreamReader> input_stream_reader_;
+  };
+
   void StartAsync();
 
   void OnReaderSeekCompleted(int content_size);
   void OnReaderReadCompleted(int bytes_read);
 
   net::HttpByteRange byte_range_;
   scoped_ptr<Delegate> delegate_;
-  scoped_refptr<android_webview::InputStreamReader> input_stream_reader_;
-  scoped_ptr<android_webview::InputStream> stream_;
+  scoped_refptr<InputStreamReaderWrapper> input_stream_reader_wrapper_;
   base::WeakPtrFactory<AndroidStreamReaderURLRequestJob> weak_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(AndroidStreamReaderURLRequestJob);
 };
 
 #endif  // ANDROID_WEBVIEW_NATIVE_ANDROID_STREAM_READER_URL_REQUEST_JOB_H_