google_apis: Fix use-after-free of URLFetcher* in ResponseWriter

google_apis/drive/base_requests.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "google_apis/drive/base_requests.h"
 
 #include "base/json/json_reader.h"
 #include "base/location.h"
 #include "base/sequenced_task_runner.h"
 #include "base/strings/string_number_conversions.h"
@@ skipping 104 matching lines @@
       get_content_callback_(get_content_callback) {
   if (!file_path.empty()) {
     file_writer_.reset(
         new net::URLFetcherFileWriter(file_task_runner, file_path));
   }
 }
 
 ResponseWriter::~ResponseWriter() {
 }
 
+void ResponseWriter::Detach() {
+  url_fetcher_ = NULL;
+}
+
 void ResponseWriter::DisownFile() {
   DCHECK(file_writer_);
   file_writer_->DisownFile();
 }
 
 int ResponseWriter::Initialize(const net::CompletionCallback& callback) {
   if (file_writer_)
     return file_writer_->Initialize(callback);
 
   data_.clear();
   return net::OK;
 }
 
 int ResponseWriter::Write(net::IOBuffer* buffer,
                           int num_bytes,
                           const net::CompletionCallback& callback) {
   // |get_content_callback_| and |file_writer_| are used only when the response
   // code is successful one.
-  if (IsSuccessfulResponseCode(url_fetcher_->GetResponseCode())) {
+  if (url_fetcher_ &&
+      IsSuccessfulResponseCode(url_fetcher_->GetResponseCode())) {
     if (!get_content_callback_.is_null()) {
       get_content_callback_.Run(
           HTTP_SUCCESS,
           make_scoped_ptr(new std::string(buffer->data(), num_bytes)));
     }
 
     if (file_writer_)
       return file_writer_->Write(buffer, num_bytes, callback);
   }
 
@@ skipping 129 matching lines @@
                                          std::string* upload_content_type) {
   return false;
 }
 
 void UrlFetchRequestBase::GetOutputFilePath(
     base::FilePath* local_file_path,
     GetContentCallback* get_content_callback) {
 }
 
 void UrlFetchRequestBase::Cancel() {
+  response_writer_->Detach();
   response_writer_ = NULL;
   url_fetcher_.reset(NULL);
   RunCallbackOnPrematureFailure(GDATA_CANCELLED);
   sender_->RequestFinished(this);
 }
 
 GDataErrorCode UrlFetchRequestBase::GetErrorCode() {
   return error_code_;
 }
 
@@ skipping 467 matching lines @@
   download_action_callback_.Run(code, temp_file);
   OnProcessURLFetchResultsComplete();
 }
 
 void DownloadFileRequestBase::RunCallbackOnPrematureFailure(
     GDataErrorCode code) {
   download_action_callback_.Run(code, base::FilePath());
 }
 
 }  // namespace google_apis