Fix a crash in net::SSLClientSocketWin::OnIOComplete(int) when...

net/socket/ssl_client_socket_nss.cc

 // Copyright (c) 2006-2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This file includes code GetDefaultCertNickname(), derived from
 // nsNSSCertificate::defaultServerNickName()
 // in mozilla/security/manager/ssl/src/nsNSSCertificate.cpp
 // and SSLClientSocketNSS::DoVerifyCertComplete() derived from
 // AuthCertificateCallback() in
 // mozilla/security/manager/ssl/src/nsNSSCallbacks.cpp.
@@ skipping 48 matching lines @@
 #define Lock FOO_NSS_Lock
 #include <ssl.h>
 #include <sslerr.h>
 #include <pk11pub.h>
 #undef Lock
 
 #include "base/compiler_specific.h"
 #include "base/logging.h"
 #include "base/nss_init.h"
 #include "base/string_util.h"
+#include "net/base/cert_verifier.h"
 #include "net/base/io_buffer.h"
 #include "net/base/net_errors.h"
 #include "net/base/ssl_info.h"
 
 static const int kRecvBufferSize = 4096;
 
 namespace net {
 
 // State machines are easier to debug if you log state transitions.
 // Enable these if you want to see what's going on.
@@ skipping 280 matching lines @@
 void SSLClientSocketNSS::Disconnect() {
   EnterFunction("");
 
   // TODO(wtc): Send SSL close_notify alert.
   if (nss_fd_ != NULL) {
     InvalidateSessionIfBadCertificate();
     PR_Close(nss_fd_);
     nss_fd_ = NULL;
   }
 
+  // Shut down anything that may call us back (through buffer_send_callback_,
+  // buffer_recv_callback, or _io_callback_).
+  verifier_.reset();
   transport_->Disconnect();
 
   // Reset object state
   transport_send_busy_ = false;
   transport_recv_busy_ = false;
   user_buf_            = NULL;
   user_buf_len_        = 0;
   server_cert_         = NULL;
   server_cert_verify_result_.Reset();
   completed_handshake_ = false;
@@ skipping 335 matching lines @@
 }
 
 int SSLClientSocketNSS::DoVerifyCert(int result) {
   DCHECK(server_cert_);
   GotoState(STATE_VERIFY_CERT_COMPLETE);
   int flags = 0;
   if (ssl_config_.rev_checking_enabled)
     flags |= X509Certificate::VERIFY_REV_CHECKING_ENABLED;
   if (ssl_config_.verify_ev_cert)
     flags |= X509Certificate::VERIFY_EV_CERT;
-  return verifier_.Verify(server_cert_, hostname_, flags,
-                          &server_cert_verify_result_, &io_callback_);
+  verifier_.reset(new CertVerifier);
+  return verifier_->Verify(server_cert_, hostname_, flags,
+                           &server_cert_verify_result_, &io_callback_);
 }
 
 // Derived from AuthCertificateCallback() in
 // mozilla/source/security/manager/ssl/src/nsNSSCallbacks.cpp.
 int SSLClientSocketNSS::DoVerifyCertComplete(int result) {
+  DCHECK(verifier_.get());
+  verifier_.reset();
+
   if (result == OK) {
     // Remember the intermediate CA certs if the server sends them to us.
     CERTCertList* cert_list = CERT_GetCertChainFromCert(
         server_cert_->os_cert_handle(), PR_Now(), certUsageSSLCA);
     if (cert_list) {
       for (CERTCertListNode* node = CERT_LIST_HEAD(cert_list);
            !CERT_LIST_END(node, cert_list);
            node = CERT_LIST_NEXT(node)) {
         if (node->cert->slot || node->cert->isRoot || node->cert->isperm ||
             node->cert == server_cert_->os_cert_handle()) {
@@ skipping 74 matching lines @@
   if (prerr == PR_WOULD_BLOCK_ERROR) {
     GotoState(STATE_PAYLOAD_WRITE);
     return ERR_IO_PENDING;
   }
   user_buf_ = NULL;
   LeaveFunction("");
   return NetErrorFromNSPRError(prerr);
 }
 
 }  // namespace net