Fix UAF in WebSocketDispatcherHost

content/browser/renderer_host/websocket_dispatcher_host.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/renderer_host/websocket_dispatcher_host.h"
 
 #include <string>
 
 #include "base/callback.h"
 #include "base/logging.h"
@@ skipping 65 matching lines @@
   }
   return host->OnMessageReceived(message, message_was_ok);
 }
 
 WebSocketHost* WebSocketDispatcherHost::GetHost(int routing_id) const {
   WebSocketHostTable::const_iterator it = hosts_.find(routing_id);
   return it == hosts_.end() ? NULL : it->second;
 }
 
 WebSocketHostState WebSocketDispatcherHost::SendOrDrop(IPC::Message* message) {
+  const uint32 message_type = message->type();
+  const int32 message_routing_id = message->routing_id();
   if (!Send(message)) {
-    DVLOG(1) << "Sending of message type " << message->type()
+    message = NULL;
+    DVLOG(1) << "Sending of message type " << message_type
              << " failed. Dropping channel.";
-    DeleteWebSocketHost(message->routing_id());
+    DeleteWebSocketHost(message_routing_id);
     return WEBSOCKET_HOST_DELETED;
   }
   return WEBSOCKET_HOST_ALIVE;
 }
 
 WebSocketHostState WebSocketDispatcherHost::SendAddChannelResponse(
     int routing_id,
     bool fail,
     const std::string& selected_protocol,
     const std::string& extensions) {
@@ skipping 67 matching lines @@
 }
 
 void WebSocketDispatcherHost::DeleteWebSocketHost(int routing_id) {
   WebSocketHostTable::iterator it = hosts_.find(routing_id);
   DCHECK(it != hosts_.end());
   delete it->second;
   hosts_.erase(it);
 }
 
 }  // namespace content