Fix UAF in Origin Info Bubble and permission settings UI.

chrome/browser/ui/website_settings/website_settings.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/website_settings/website_settings.h"
 
 #include <string>
 #include <vector>
 
 #include "base/command_line.h"
 #include "base/i18n/time_formatting.h"
 #include "base/metrics/field_trial.h"
 #include "base/metrics/histogram.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/stringprintf.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/values.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/browsing_data/browsing_data_channel_id_helper.h"
 #include "chrome/browser/browsing_data/browsing_data_cookie_helper.h"
 #include "chrome/browser/browsing_data/browsing_data_database_helper.h"
 #include "chrome/browser/browsing_data/browsing_data_file_system_helper.h"
 #include "chrome/browser/browsing_data/browsing_data_indexed_db_helper.h"
 #include "chrome/browser/browsing_data/browsing_data_local_storage_helper.h"
 #include "chrome/browser/history/history_service_factory.h"
+#include "chrome/browser/infobars/infobar_service.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/ssl/chrome_ssl_host_state_delegate.h"
 #include "chrome/browser/ssl/chrome_ssl_host_state_delegate_factory.h"
 #include "chrome/browser/ssl/ssl_error_info.h"
 #include "chrome/browser/ui/website_settings/website_settings_infobar_delegate.h"
 #include "chrome/browser/ui/website_settings/website_settings_ui.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/grit/chromium_strings.h"
 #include "chrome/grit/generated_resources.h"
 #include "components/content_settings/core/browser/content_settings_utils.h"
@@ skipping 103 matching lines @@
   return is_ev ? WebsiteSettings::SITE_IDENTITY_STATUS_EV_CERT
                : WebsiteSettings::SITE_IDENTITY_STATUS_CERT;
 }
 
 }  // namespace
 
 WebsiteSettings::WebsiteSettings(
     WebsiteSettingsUI* ui,
     Profile* profile,
     TabSpecificContentSettings* tab_specific_content_settings,
-    InfoBarService* infobar_service,
+    content::WebContents* web_contents,
     const GURL& url,
     const content::SSLStatus& ssl,
     content::CertStore* cert_store)
     : TabSpecificContentSettings::SiteDataObserver(
           tab_specific_content_settings),
       ui_(ui),
-      infobar_service_(infobar_service),
+      web_contents_(web_contents),
       show_info_bar_(false),
       site_url_(url),
       site_identity_status_(SITE_IDENTITY_STATUS_UNKNOWN),
       cert_id_(0),
       site_connection_status_(SITE_CONNECTION_STATUS_UNKNOWN),
       cert_store_(cert_store),
       content_settings_(profile->GetHostContentSettingsMap()),
       chrome_ssl_host_state_delegate_(
           ChromeSSLHostStateDelegateFactory::GetForProfile(profile)),
       did_revoke_user_ssl_decisions_(false) {
@@ skipping 147 matching lines @@
   // Refresh the UI to reflect the new setting.
   PresentSitePermissions();
 #endif
 }
 
 void WebsiteSettings::OnSiteDataAccessed() {
   PresentSiteData();
 }
 
 void WebsiteSettings::OnUIClosing() {
-  if (show_info_bar_)
-    WebsiteSettingsInfoBarDelegate::Create(infobar_service_);
+  if (show_info_bar_) {
+    InfoBarService* infobar_service =
+        InfoBarService::FromWebContents(web_contents_);

[felt, 2015/08/25 22:30:43]

does this fail gracefully if web_contents is a nullptr? or do you need
if(show_info_bar_ && web_contents) ?

[palmer, 2015/08/25 22:40:50]

We do need the check; it would deref the nullptr. Fixed.

+    if (infobar_service)
+      WebsiteSettingsInfoBarDelegate::Create(infobar_service);
+  }
 
   SSLCertificateDecisionsDidRevoke user_decision =
       did_revoke_user_ssl_decisions_ ? USER_CERT_DECISIONS_REVOKED
                                      : USER_CERT_DECISIONS_NOT_REVOKED;
 
   UMA_HISTOGRAM_ENUMERATION("interstitial.ssl.did_user_revoke_decisions",
                             user_decision,
                             END_OF_SSL_CERTIFICATE_DECISIONS_DID_REVOKE_ENUM);
 }
 
@@ skipping 384 matching lines @@
   info.connection_status = site_connection_status_;
   info.connection_status_description =
       UTF16ToUTF8(site_connection_details_);
   info.identity_status = site_identity_status_;
   info.identity_status_description =
       UTF16ToUTF8(site_identity_details_);
   info.cert_id = cert_id_;
   info.show_ssl_decision_revoke_button = show_ssl_decision_revoke_button_;
   ui_->SetIdentityInfo(info);
 }