[GCM] Fix use after free memory issue in gcm store

google_apis/gcm/engine/gcm_store_impl.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "google_apis/gcm/engine/gcm_store_impl.h"
 
 #include "base/basictypes.h"
 #include "base/bind.h"
 #include "base/callback.h"
 #include "base/file_util.h"
@@ skipping 61 matching lines @@
 }
 
 std::string ParseOutgoingKey(const std::string& key) {
   return key.substr(arraysize(kOutgoingMsgKeyStart) - 1);
 }
 
 std::string ParseUsername(const std::string& key) {
   return key.substr(arraysize(kUserSerialNumberKeyStart) - 1);
 }
 
+// Note: leveldb::Slice keeps a pointer to the data in |s|, which must therefore
+// outlive the slice.
+// For example: MakeSlice(MakeOutgoingKey(x)) is invalid.
 leveldb::Slice MakeSlice(const base::StringPiece& s) {
   return leveldb::Slice(s.begin(), s.size());
 }
 
 }  // namespace
 
 class GCMStoreImpl::Backend
     : public base::RefCountedThreadSafe<GCMStoreImpl::Backend> {
  public:
   Backend(const base::FilePath& path,
@@ skipping 133 matching lines @@
     foreground_task_runner_->PostTask(FROM_HERE, base::Bind(callback, false));
     return;
   }
 
   leveldb::WriteOptions write_options;
   write_options.sync = true;
 
   std::string encrypted_token;
   Encryptor::EncryptString(base::Uint64ToString(device_security_token),
                            &encrypted_token);
+  std::string android_id_str = base::Uint64ToString(device_android_id);
   leveldb::Status s =
       db_->Put(write_options,
                MakeSlice(kDeviceAIDKey),
-               MakeSlice(base::Uint64ToString(device_android_id)));
+               MakeSlice(android_id_str));
   if (s.ok()) {
     s = db_->Put(
         write_options, MakeSlice(kDeviceTokenKey), MakeSlice(encrypted_token));
   }
   if (s.ok()) {
     foreground_task_runner_->PostTask(FROM_HERE, base::Bind(callback, true));
     return;
   }
   LOG(ERROR) << "LevelDB put failed: " << s.ToString();
   foreground_task_runner_->PostTask(FROM_HERE, base::Bind(callback, false));
 }
 
 void GCMStoreImpl::Backend::AddIncomingMessage(const std::string& persistent_id,
                                                const UpdateCallback& callback) {
   DVLOG(1) << "Saving incoming message with id " << persistent_id;
   if (!db_.get()) {
     LOG(ERROR) << "GCMStore db doesn't exist.";
     foreground_task_runner_->PostTask(FROM_HERE, base::Bind(callback, false));
     return;
   }
 
   leveldb::WriteOptions write_options;
   write_options.sync = true;
 
+  std::string key = MakeIncomingKey(persistent_id);
   const leveldb::Status s = db_->Put(write_options,
-                                     MakeSlice(MakeIncomingKey(persistent_id)),
+                                     MakeSlice(key),
                                      MakeSlice(persistent_id));
   if (s.ok()) {
     foreground_task_runner_->PostTask(FROM_HERE, base::Bind(callback, true));
     return;
   }
   LOG(ERROR) << "LevelDB put failed: " << s.ToString();
   foreground_task_runner_->PostTask(FROM_HERE, base::Bind(callback, false));
 }
 
 void GCMStoreImpl::Backend::RemoveIncomingMessages(
     const PersistentIdList& persistent_ids,
     const UpdateCallback& callback) {
   if (!db_.get()) {
     LOG(ERROR) << "GCMStore db doesn't exist.";
     foreground_task_runner_->PostTask(FROM_HERE, base::Bind(callback, false));
     return;
   }
   leveldb::WriteOptions write_options;
   write_options.sync = true;
 
   leveldb::Status s;
   for (PersistentIdList::const_iterator iter = persistent_ids.begin();
        iter != persistent_ids.end();
        ++iter) {
     DVLOG(1) << "Removing incoming message with id " << *iter;
-    s = db_->Delete(write_options, MakeSlice(MakeIncomingKey(*iter)));
+    std::string key = MakeIncomingKey(*iter);
+    s = db_->Delete(write_options, MakeSlice(key));
     if (!s.ok())
       break;
   }
   if (s.ok()) {
     foreground_task_runner_->PostTask(FROM_HERE, base::Bind(callback, true));
     return;
   }
   LOG(ERROR) << "LevelDB remove failed: " << s.ToString();
   foreground_task_runner_->PostTask(FROM_HERE, base::Bind(callback, false));
 }
 
 void GCMStoreImpl::Backend::AddOutgoingMessage(const std::string& persistent_id,
                                                const MCSMessage& message,
                                                const UpdateCallback& callback) {
   DVLOG(1) << "Saving outgoing message with id " << persistent_id;
   if (!db_.get()) {
     LOG(ERROR) << "GCMStore db doesn't exist.";
     foreground_task_runner_->PostTask(FROM_HERE, base::Bind(callback, false));
     return;
   }
   leveldb::WriteOptions write_options;
   write_options.sync = true;
 
   std::string data =
       static_cast<char>(message.tag()) + message.SerializeAsString();
+  std::string key = MakeOutgoingKey(persistent_id);
   const leveldb::Status s = db_->Put(write_options,
-                                     MakeSlice(MakeOutgoingKey(persistent_id)),
+                                     MakeSlice(key),
                                      MakeSlice(data));
   if (s.ok()) {
     foreground_task_runner_->PostTask(FROM_HERE, base::Bind(callback, true));
     return;
   }
   LOG(ERROR) << "LevelDB put failed: " << s.ToString();
   foreground_task_runner_->PostTask(FROM_HERE, base::Bind(callback, false));
 }
 
 void GCMStoreImpl::Backend::RemoveOutgoingMessages(
@@ skipping 13 matching lines @@
   write_options.sync = true;
 
   AppIdToMessageCountMap removed_message_counts;
 
   leveldb::Status s;
   for (PersistentIdList::const_iterator iter = persistent_ids.begin();
        iter != persistent_ids.end();
        ++iter) {
     DVLOG(1) << "Removing outgoing message with id " << *iter;
     std::string outgoing_message;
-    leveldb::Slice key_slice = MakeSlice(MakeOutgoingKey(*iter));
-    s = db_->Get(read_options, key_slice, &outgoing_message);
+    std::string key = MakeOutgoingKey(*iter);
+    s = db_->Get(read_options,
+                 MakeSlice(key),
+                 &outgoing_message);
     if (!s.ok())
       break;
     mcs_proto::DataMessageStanza data_message;
     // Skip the initial tag byte and parse the rest to extract the message.
     if (data_message.ParseFromString(outgoing_message.substr(1))) {
       DCHECK(!data_message.from().empty());
       if (removed_message_counts.count(data_message.from()) != 0)
         removed_message_counts[data_message.from()]++;
       else
         removed_message_counts[data_message.from()] = 1;
     }
     DVLOG(1) << "Removing outgoing message with id " << *iter;
-    // Have to create a new slice to perform the deletion.
-    s = db_->Delete(write_options, MakeSlice(MakeOutgoingKey(*iter)));
+    s = db_->Delete(write_options, MakeSlice(key));
     if (!s.ok())
       break;
   }
   if (s.ok()) {
     foreground_task_runner_->PostTask(FROM_HERE,
                                       base::Bind(callback,
                                                  true,
                                                  removed_message_counts));
     return;
   }
@@ skipping 10 matching lines @@
     const UpdateCallback& callback) {
   DVLOG(1) << "Saving username to serial number mapping for user: " << username;
   if (!db_.get()) {
     LOG(ERROR) << "GCMStore db doesn't exist.";
     foreground_task_runner_->PostTask(FROM_HERE, base::Bind(callback, false));
     return;
   }
   leveldb::WriteOptions write_options;
   write_options.sync = true;
 
+  std::string key = MakeUserSerialNumberKey(username);
+  std::string serial_number_str = base::Int64ToString(serial_number);
   const leveldb::Status status =
       db_->Put(write_options,
-               MakeSlice(MakeUserSerialNumberKey(username)),
-               MakeSlice(base::Int64ToString(serial_number)));
+               MakeSlice(key),
+               MakeSlice(serial_number_str));
   if (status.ok()) {
     foreground_task_runner_->PostTask(FROM_HERE, base::Bind(callback, true));
     return;
   }
   LOG(ERROR) << "LevelDB put failed: " << status.ToString();
   foreground_task_runner_->PostTask(FROM_HERE, base::Bind(callback, false));
 }
 
 void GCMStoreImpl::Backend::RemoveUserSerialNumber(
     const std::string& username,
@@ skipping 21 matching lines @@
   DVLOG(1) << "Updating the value of next user serial number to: "
            << next_serial_number;
   if (!db_.get()) {
     LOG(ERROR) << "GCMStore db doesn't exist.";
     foreground_task_runner_->PostTask(FROM_HERE, base::Bind(callback, false));
     return;
   }
   leveldb::WriteOptions write_options;
   write_options.sync = true;
 
+  std::string serial_number_str = base::Int64ToString(next_serial_number);
   const leveldb::Status status =
       db_->Put(write_options,
                MakeSlice(kNextSerialNumberKey),
-               MakeSlice(base::Int64ToString(next_serial_number)));
+               MakeSlice(serial_number_str));
   if (status.ok()) {
     foreground_task_runner_->PostTask(FROM_HERE, base::Bind(callback, true));
     return;
   }
   LOG(ERROR) << "LevelDB put failed: " << status.ToString();
   foreground_task_runner_->PostTask(FROM_HERE, base::Bind(callback, false));
 }
 
 bool GCMStoreImpl::Backend::LoadDeviceCredentials(uint64* android_id,
                                                   uint64* security_token) {
@@ skipping 333 matching lines @@
            removed_message_counts.begin();
        iter != removed_message_counts.end(); ++iter) {
     DCHECK_NE(app_message_counts_.count(iter->first), 0U);
     app_message_counts_[iter->first] -= iter->second;
     DCHECK_GE(app_message_counts_[iter->first], 0);
   }
   callback.Run(true);
 }
 
 }  // namespace gcm