Fix possible map::end() dereference in AppCacheUpdateJob triggered by a compromised renderer.

content/browser/appcache/appcache_host.h

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_BROWSER_APPCACHE_APPCACHE_HOST_H_
 #define CONTENT_BROWSER_APPCACHE_APPCACHE_HOST_H_
 
 #include "base/callback.h"
 #include "base/gtest_prod_util.h"
 #include "base/memory/ref_counted.h"
@@ skipping 15 matching lines @@
 FORWARD_DECLARE_TEST(AppCacheGroupTest, QueueUpdate);
 FORWARD_DECLARE_TEST(AppCacheHostTest, Basic);
 FORWARD_DECLARE_TEST(AppCacheHostTest, SelectNoCache);
 FORWARD_DECLARE_TEST(AppCacheHostTest, ForeignEntry);
 FORWARD_DECLARE_TEST(AppCacheHostTest, FailedCacheLoad);
 FORWARD_DECLARE_TEST(AppCacheHostTest, FailedGroupLoad);
 FORWARD_DECLARE_TEST(AppCacheHostTest, SetSwappableCache);
 FORWARD_DECLARE_TEST(AppCacheHostTest, ForDedicatedWorker);
 FORWARD_DECLARE_TEST(AppCacheHostTest, SelectCacheAllowed);
 FORWARD_DECLARE_TEST(AppCacheHostTest, SelectCacheBlocked);
+FORWARD_DECLARE_TEST(AppCacheHostTest, SelectCacheTwice);
 FORWARD_DECLARE_TEST(AppCacheTest, CleanupUnusedCache);
 class AppCache;
 class AppCacheFrontend;
 class AppCacheGroupTest;
 class AppCacheHostTest;
 class AppCacheRequestHandler;
 class AppCacheRequestHandlerTest;
 class AppCacheStorageImplTest;
 class AppCacheTest;
 class AppCacheUpdateJobTest;
@@ skipping 23 matching lines @@
   AppCacheHost(int host_id, AppCacheFrontend* frontend,
                AppCacheServiceImpl* service);
   ~AppCacheHost() override;
 
   // Adds/removes an observer, the AppCacheHost does not take
   // ownership of the observer.
   void AddObserver(Observer* observer);
   void RemoveObserver(Observer* observer);
 
   // Support for cache selection and scriptable method calls.
-  void SelectCache(const GURL& document_url,
+  bool SelectCache(const GURL& document_url,
                    const int64 cache_document_was_loaded_from,
                    const GURL& manifest_url);
-  void SelectCacheForWorker(int parent_process_id,
+  bool SelectCacheForWorker(int parent_process_id,
                             int parent_host_id);
-  void SelectCacheForSharedWorker(int64 appcache_id);
-  void MarkAsForeignEntry(const GURL& document_url,
+  bool SelectCacheForSharedWorker(int64 appcache_id);
+  bool MarkAsForeignEntry(const GURL& document_url,
                           int64 cache_document_was_loaded_from);
   void GetStatusWithCallback(const GetStatusCallback& callback,
                              void* callback_param);
   void StartUpdateWithCallback(const StartUpdateCallback& callback,
                                void* callback_param);
   void SwapCacheWithCallback(const SwapCacheCallback& callback,
                              void* callback_param);
 
   // Called prior to the main resource load. When the system contains multiple
   // candidates for a main resource load, the appcache preferred by the host
@@ skipping 60 matching lines @@
   // with which pending master entries.
   const GURL& pending_master_entry_url() const {
     return new_master_entry_url_;
   }
 
   int host_id() const { return host_id_; }
   AppCacheServiceImpl* service() const { return service_; }
   AppCacheStorage* storage() const { return storage_; }
   AppCacheFrontend* frontend() const { return frontend_; }
   AppCache* associated_cache() const { return associated_cache_.get(); }
-  bool was_select_cache_called() const { return was_select_cache_called_; }
 
   void enable_cache_selection(bool enable) {
     is_cache_selection_enabled_ = enable;
   }
 
   bool is_selection_pending() const {
     return pending_selected_cache_id_ != kAppCacheNoCacheId ||
            !pending_selected_manifest_url_.is_empty();
   }
 
@@ skipping 152 matching lines @@
   FRIEND_TEST_ALL_PREFIXES(content::AppCacheGroupTest, QueueUpdate);
   FRIEND_TEST_ALL_PREFIXES(content::AppCacheHostTest, Basic);
   FRIEND_TEST_ALL_PREFIXES(content::AppCacheHostTest, SelectNoCache);
   FRIEND_TEST_ALL_PREFIXES(content::AppCacheHostTest, ForeignEntry);
   FRIEND_TEST_ALL_PREFIXES(content::AppCacheHostTest, FailedCacheLoad);
   FRIEND_TEST_ALL_PREFIXES(content::AppCacheHostTest, FailedGroupLoad);
   FRIEND_TEST_ALL_PREFIXES(content::AppCacheHostTest, SetSwappableCache);
   FRIEND_TEST_ALL_PREFIXES(content::AppCacheHostTest, ForDedicatedWorker);
   FRIEND_TEST_ALL_PREFIXES(content::AppCacheHostTest, SelectCacheAllowed);
   FRIEND_TEST_ALL_PREFIXES(content::AppCacheHostTest, SelectCacheBlocked);
+  FRIEND_TEST_ALL_PREFIXES(content::AppCacheHostTest, SelectCacheTwice);
   FRIEND_TEST_ALL_PREFIXES(content::AppCacheTest, CleanupUnusedCache);
 
   DISALLOW_COPY_AND_ASSIGN(AppCacheHost);
 };
 
 }  // namespace content
 
 #endif  // CONTENT_BROWSER_APPCACHE_APPCACHE_HOST_H_