[android_webview] Fix use after free in intercepted requests.

android_webview/native/android_protocol_handler.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "android_webview/native/android_protocol_handler.h"
 
 #include "android_webview/browser/net/android_stream_reader_url_request_job.h"
 #include "android_webview/common/url_constants.h"
 #include "android_webview/native/input_stream_impl.h"
 #include "base/android/jni_android.h"
@@ skipping 36 matching lines @@
     : public AndroidStreamReaderURLRequestJob::Delegate {
  public:
   AndroidStreamReaderURLRequestJobDelegateImpl();
 
   virtual scoped_ptr<InputStream> OpenInputStream(
       JNIEnv* env,
       net::URLRequest* request) OVERRIDE;
 
   virtual bool GetMimeType(JNIEnv* env,
                            net::URLRequest* request,
-                           const InputStream& stream,
+                           InputStream* stream,
                            std::string* mime_type) OVERRIDE;
 
   virtual bool GetCharset(JNIEnv* env,
                           net::URLRequest* request,
-                          const InputStream& stream,
+                          InputStream* stream,
                           std::string* charset) OVERRIDE;
 
   virtual ~AndroidStreamReaderURLRequestJobDelegateImpl();
 };
 
 class AssetFileProtocolInterceptor :
       public net::URLRequestJobFactory::Interceptor {
  public:
   AssetFileProtocolInterceptor();
   virtual ~AssetFileProtocolInterceptor() OVERRIDE;
@@ skipping 71 matching lines @@
   if (ClearException(env) || stream.is_null()) {
     DLOG(ERROR) << "Unable to open input stream for Android URL";
     return scoped_ptr<InputStream>();
   }
   return make_scoped_ptr<InputStream>(new InputStreamImpl(stream));
 }
 
 bool AndroidStreamReaderURLRequestJobDelegateImpl::GetMimeType(
     JNIEnv* env,
     net::URLRequest* request,
-    const android_webview::InputStream& stream,
+    android_webview::InputStream* stream,
     std::string* mime_type) {
   DCHECK(env);
   DCHECK(request);
   DCHECK(mime_type);
 
   // Query the mime type from the Java side. It is possible for the query to
   // fail, as the mime type cannot be determined for all supported schemes.
   ScopedJavaLocalRef<jstring> url =
       ConvertUTF8ToJavaString(env, request->url().spec());
   const InputStreamImpl* stream_impl =
-      InputStreamImpl::FromInputStream(&stream);
+      InputStreamImpl::FromInputStream(stream);
   ScopedJavaLocalRef<jstring> returned_type =
       android_webview::Java_AndroidProtocolHandler_getMimeType(
           env,
           GetResourceContext(env).obj(),
           stream_impl->jobj(), url.obj());
   if (ClearException(env) || returned_type.is_null())
     return false;
 
   *mime_type = base::android::ConvertJavaStringToUTF8(returned_type);
   return true;
 }
 
 bool AndroidStreamReaderURLRequestJobDelegateImpl::GetCharset(
     JNIEnv* env,
     net::URLRequest* request,
-    const android_webview::InputStream& stream,
+    android_webview::InputStream* stream,
     std::string* charset) {
   // TODO: We should probably be getting this from the managed side.
   return false;
 }
 
 AssetFileProtocolInterceptor::AssetFileProtocolInterceptor()
     : asset_prefix_(std::string(chrome::kFileScheme) +
                     std::string(content::kStandardSchemeSeparator) +
                     android_webview::kAndroidAssetPath),
       resource_prefix_(std::string(chrome::kFileScheme) +
@@ skipping 79 matching lines @@
       env, android_webview::kAndroidAssetPath).Release();
 }
 
 static jstring GetAndroidResourcePath(JNIEnv* env, jclass /*clazz*/) {
   // OK to release, JNI binding.
   return ConvertUTF8ToJavaString(
       env, android_webview::kAndroidResourcePath).Release();
 }
 
 }  // namespace android_webview