[android_webview] Fix use after free in intercepted requests.

android_webview/native/android_protocol_handler.cc

Index: android_webview/native/android_protocol_handler.cc
diff --git a/android_webview/native/android_protocol_handler.cc b/android_webview/native/android_protocol_handler.cc
index 839c4e3d5d0c9c5b30cc428434540b50997bab57..62ecd1ac1f3bb217fae3f60fedfe56dfc32b80d3 100644
--- a/android_webview/native/android_protocol_handler.cc
+++ b/android_webview/native/android_protocol_handler.cc
@@ -54,12 +54,12 @@ class AndroidStreamReaderURLRequestJobDelegateImpl
 
   virtual bool GetMimeType(JNIEnv* env,
                            net::URLRequest* request,
-                           const InputStream& stream,
+                           InputStream& stream,

[joth, 2012/11/29 17:44:09]

use pointer: non-const references not allowed. 

[mkosiba (inactive), 2012/11/29 18:54:11]

ah, well, back to ye olde pointer then

                            std::string* mime_type) OVERRIDE;
 
   virtual bool GetCharset(JNIEnv* env,
                           net::URLRequest* request,
-                          const InputStream& stream,
+                          InputStream& stream,
                           std::string* charset) OVERRIDE;
 
   virtual ~AndroidStreamReaderURLRequestJobDelegateImpl();
@@ -151,7 +151,7 @@ AndroidStreamReaderURLRequestJobDelegateImpl::OpenInputStream(
 bool AndroidStreamReaderURLRequestJobDelegateImpl::GetMimeType(
     JNIEnv* env,
     net::URLRequest* request,
-    const android_webview::InputStream& stream,
+    android_webview::InputStream& stream,
     std::string* mime_type) {
   DCHECK(env);
   DCHECK(request);
@@ -178,7 +178,7 @@ bool AndroidStreamReaderURLRequestJobDelegateImpl::GetMimeType(
 bool AndroidStreamReaderURLRequestJobDelegateImpl::GetCharset(
     JNIEnv* env,
     net::URLRequest* request,
-    const android_webview::InputStream& stream,
+    android_webview::InputStream& stream,
     std::string* charset) {
   // TODO: We should probably be getting this from the managed side.
   return false;