google_apis: Fix use-after-free of URLFetcher* in ResponseWriter

google_apis/drive/base_requests.cc

Index: google_apis/drive/base_requests.cc
diff --git a/google_apis/drive/base_requests.cc b/google_apis/drive/base_requests.cc
index 4a5ca708781b26fcbe46fd2e14bf264be3211392..dc45b3f51b3da86da187b1f389fb0d9fdad820b8 100644
--- a/google_apis/drive/base_requests.cc
+++ b/google_apis/drive/base_requests.cc
@@ -122,6 +122,10 @@ ResponseWriter::ResponseWriter(net::URLFetcher* url_fetcher,
 ResponseWriter::~ResponseWriter() {
 }
 
+void ResponseWriter::Detach() {
+  url_fetcher_ = NULL;
+}
+
 void ResponseWriter::DisownFile() {
   DCHECK(file_writer_);
   file_writer_->DisownFile();
@@ -140,7 +144,8 @@ int ResponseWriter::Write(net::IOBuffer* buffer,
                           const net::CompletionCallback& callback) {
   // |get_content_callback_| and |file_writer_| are used only when the response
   // code is successful one.
-  if (IsSuccessfulResponseCode(url_fetcher_->GetResponseCode())) {
+  if (url_fetcher_ &&
+      IsSuccessfulResponseCode(url_fetcher_->GetResponseCode())) {
     if (!get_content_callback_.is_null()) {
       get_content_callback_.Run(
           HTTP_SUCCESS,
@@ -290,6 +295,7 @@ void UrlFetchRequestBase::GetOutputFilePath(
 }
 
 void UrlFetchRequestBase::Cancel() {
+  response_writer_->Detach();
   response_writer_ = NULL;
   url_fetcher_.reset(NULL);
   RunCallbackOnPrematureFailure(GDATA_CANCELLED);