Fix possible map::end() dereference in AppCacheUpdateJob triggered by a compromised renderer.

content/browser/appcache/appcache_host.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/appcache/appcache_host.h"
 
 #include "base/logging.h"
 #include "base/strings/string_util.h"
 #include "base/strings/stringprintf.h"
 #include "content/browser/appcache/appcache.h"
@@ skipping 62 matching lines @@
 }
 
 void AppCacheHost::AddObserver(Observer* observer) {
   observers_.AddObserver(observer);
 }
 
 void AppCacheHost::RemoveObserver(Observer* observer) {
   observers_.RemoveObserver(observer);
 }
 
-void AppCacheHost::SelectCache(const GURL& document_url,
+bool AppCacheHost::SelectCache(const GURL& document_url,
                                const int64 cache_document_was_loaded_from,
                                const GURL& manifest_url) {
+  if (was_select_cache_called_)
+    return false;
+
   DCHECK(pending_start_update_callback_.is_null() &&
          pending_swap_cache_callback_.is_null() &&
          pending_get_status_callback_.is_null() &&
-         !is_selection_pending() && !was_select_cache_called_);
+         !is_selection_pending());
 
   was_select_cache_called_ = true;
   if (!is_cache_selection_enabled_) {
     FinishCacheSelection(NULL, NULL);
-    return;
+    return true;
   }
 
   origin_in_use_ = document_url.GetOrigin();
   if (service()->quota_manager_proxy() && !origin_in_use_.is_empty())
     service()->quota_manager_proxy()->NotifyOriginInUse(origin_in_use_);
 
   if (main_resource_blocked_)
     frontend_->OnContentBlocked(host_id_,
                                 blocked_manifest_url_);
 
   // 6.9.6 The application cache selection algorithm.
   // The algorithm is started here and continues in FinishCacheSelection,
   // after cache or group loading is complete.
   // Note: Foreign entries are detected on the client side and
   // MarkAsForeignEntry is called in that case, so that detection
   // step is skipped here. See WebApplicationCacheHostImpl.cc
 
   if (cache_document_was_loaded_from != kAppCacheNoCacheId) {
     LoadSelectedCache(cache_document_was_loaded_from);
-    return;
+    return true;
   }
 
   if (!manifest_url.is_empty() &&
       (manifest_url.GetOrigin() == document_url.GetOrigin())) {
     DCHECK(!first_party_url_.is_empty());
     AppCachePolicy* policy = service()->appcache_policy();
     if (policy &&
         !policy->CanCreateAppCache(manifest_url, first_party_url_)) {
       FinishCacheSelection(NULL, NULL);
       std::vector<int> host_ids(1, host_id_);
       frontend_->OnEventRaised(host_ids, APPCACHE_CHECKING_EVENT);
       frontend_->OnErrorEventRaised(
           host_ids,
           AppCacheErrorDetails(
               "Cache creation was blocked by the content policy",
               APPCACHE_POLICY_ERROR,
               GURL(),
               0,
               false /*is_cross_origin*/));
       frontend_->OnContentBlocked(host_id_, manifest_url);
-      return;
+      return true;
     }
 
     // Note: The client detects if the document was not loaded using HTTP GET
     // and invokes SelectCache without a manifest url, so that detection step
     // is also skipped here. See WebApplicationCacheHostImpl.cc
     set_preferred_manifest_url(manifest_url);
     new_master_entry_url_ = document_url;
     LoadOrCreateGroup(manifest_url);
-    return;
+    return true;
   }
 
   // TODO(michaeln): If there was a manifest URL, the user agent may report
   // to the user that it was ignored, to aid in application development.
   FinishCacheSelection(NULL, NULL);
+  return true;
 }
 
-void AppCacheHost::SelectCacheForWorker(int parent_process_id,
+bool AppCacheHost::SelectCacheForWorker(int parent_process_id,
                                         int parent_host_id) {
+  if (was_select_cache_called_)
+    return false;
+
   DCHECK(pending_start_update_callback_.is_null() &&
          pending_swap_cache_callback_.is_null() &&
          pending_get_status_callback_.is_null() &&
-         !is_selection_pending() && !was_select_cache_called_);
+         !is_selection_pending());
 
   was_select_cache_called_ = true;
   parent_process_id_ = parent_process_id;
   parent_host_id_ = parent_host_id;
   FinishCacheSelection(NULL, NULL);
+  return true;
 }
 
-void AppCacheHost::SelectCacheForSharedWorker(int64 appcache_id) {
+bool AppCacheHost::SelectCacheForSharedWorker(int64 appcache_id) {
+  if (was_select_cache_called_)
+    return false;
+
   DCHECK(pending_start_update_callback_.is_null() &&
          pending_swap_cache_callback_.is_null() &&
          pending_get_status_callback_.is_null() &&
-         !is_selection_pending() && !was_select_cache_called_);
+         !is_selection_pending());
 
   was_select_cache_called_ = true;
   if (appcache_id != kAppCacheNoCacheId) {
     LoadSelectedCache(appcache_id);
-    return;
+    return true;
   }
   FinishCacheSelection(NULL, NULL);
+  return true;
 }
 
 // TODO(michaeln): change method name to MarkEntryAsForeign for consistency
-void AppCacheHost::MarkAsForeignEntry(const GURL& document_url,
+bool AppCacheHost::MarkAsForeignEntry(const GURL& document_url,
                                       int64 cache_document_was_loaded_from) {
+  if (was_select_cache_called_)
+    return false;
+
   // The document url is not the resource url in the fallback case.
   storage()->MarkEntryAsForeign(
       main_resource_was_namespace_entry_ ? namespace_entry_url_ : document_url,
       cache_document_was_loaded_from);
   SelectCache(document_url, kAppCacheNoCacheId, GURL());
+  return true;
 }
 
 void AppCacheHost::GetStatusWithCallback(const GetStatusCallback& callback,
                                          void* callback_param) {
   DCHECK(pending_start_update_callback_.is_null() &&
          pending_swap_cache_callback_.is_null() &&
          pending_get_status_callback_.is_null());
 
   pending_get_status_callback_ = callback;
   pending_callback_param_ = callback_param;
@@ skipping 354 matching lines @@
   associated_cache_info_pending_ = cache && !cache->is_complete();
   AppCacheInfo info;
   if (cache)
     cache->AssociateHost(this);
 
   FillCacheInfo(cache, manifest_url, GetStatus(), &info);
   frontend_->OnCacheSelected(host_id_, info);
 }
 
 }  // namespace content