Attempt to fix use-after-free in VersionUpdaterWin.

chrome/browser/ui/webui/help/version_updater_win.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/memory/ref_counted.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/memory/weak_ptr.h"
 #include "base/string16.h"
 #include "base/version.h"
 #include "base/win/windows_version.h"
@@ skipping 41 matching lines @@
 
   // Update the UI to show the status of the upgrade.
   void UpdateStatus(GoogleUpdateUpgradeResult result,
                     GoogleUpdateErrorCode error_code,
                     const string16& error_message);
 
   // Got the intalled version so the handling of the UPGRADE_ALREADY_UP_TO_DATE
   // result case can now be completeb on the UI thread.
   void GotInstalledVersion(const Version& version);
 
-  // Little helper function to reset google_updater_.
-  void SetGoogleUpdater();
+  // Little helper function to create google_updater_.
+  void CreateGoogleUpdater();
+
+  // Helper function to clear google_updater_.
+  void ClearGoogleUpdater();
 
   // Returns a window that can be used for elevation.
   HWND GetElevationParent();
 
   // The class that communicates with Google Update to find out if an update is
   // available and asks it to start an upgrade.
   scoped_refptr<GoogleUpdate> google_updater_;
 
   // Used for callbacks.
   base::WeakPtrFactory<VersionUpdaterWin> weak_factory_;
@@ skipping 40 matching lines @@
   // We use a weak pointer in case the updater gets destroyed while waiting.
   base::WeakPtr<VersionUpdaterWin> version_updater_;
 
   // This is the version that gets read in the FILE thread and set on the
   // the updater in the UI thread.
   Version installed_version_;
 };
 
 VersionUpdaterWin::VersionUpdaterWin()
     : weak_factory_(this) {
-  SetGoogleUpdater();
+  CreateGoogleUpdater();
 }
 
 VersionUpdaterWin::~VersionUpdaterWin() {
   // The Google Updater will hold a pointer to the listener until it reports
   // status, so that pointer must be cleared when the listener is destoyed.
-  if (google_updater_)
-    google_updater_->set_status_listener(NULL);
+  ClearGoogleUpdater();
 }
 
 void VersionUpdaterWin::CheckForUpdate(const StatusCallback& callback) {
   callback_ = callback;
 
   // On-demand updates for Chrome don't work in Vista RTM when UAC is turned
   // off. So, in this case, the version updater must not mention
   // on-demand updates. Silent updates (in the background) should still
   // work as before - enabling UAC or installing the latest service pack
   // for Vista is another option.
   if (!(base::win::GetVersion() == base::win::VERSION_VISTA &&
         (base::win::OSInfo::GetInstance()->service_pack().major == 0) &&
         !base::win::UserAccountControlIsEnabled())) {
     // This could happen if the page got refreshed after results were returned.
     if (!google_updater_)
-      SetGoogleUpdater();
+      CreateGoogleUpdater();
     UpdateStatus(UPGRADE_CHECK_STARTED, GOOGLE_UPDATE_NO_ERROR, string16());
     // Specify false to not upgrade yet.
     google_updater_->CheckForUpdate(false, GetElevationParent());
   }
 }
 
 void VersionUpdaterWin::RelaunchBrowser() const {
   chrome::AttemptRestart();
 }
 
 void VersionUpdaterWin::OnReportResults(
     GoogleUpdateUpgradeResult result, GoogleUpdateErrorCode error_code,
     const string16& error_message, const string16& version) {
   // Drop the last reference to the object so that it gets cleaned up here.
-  google_updater_ = NULL;
+  ClearGoogleUpdater();
   UpdateStatus(result, error_code, error_message);
 }
 
 void VersionUpdaterWin::UpdateStatus(GoogleUpdateUpgradeResult result,
                                      GoogleUpdateErrorCode error_code,
                                      const string16& error_message) {
   // For Chromium builds it would show an error message.
   // But it looks weird because in fact there is no error,
   // just the update server is not available for non-official builds.
 #if defined(GOOGLE_CHROME_BUILD)
   Status status = UPDATED;
   string16 message;
 
   switch (result) {
     case UPGRADE_CHECK_STARTED: {
       content::RecordAction(UserMetricsAction("UpgradeCheck_Started"));
       status = CHECKING;
       break;
     }
     case UPGRADE_STARTED: {
       content::RecordAction(UserMetricsAction("Upgrade_Started"));
       status = UPDATING;
       break;
     }
     case UPGRADE_IS_AVAILABLE: {
       content::RecordAction(
           UserMetricsAction("UpgradeCheck_UpgradeIsAvailable"));
       DCHECK(!google_updater_);  // Should have been nulled out already.
-      SetGoogleUpdater();
+      CreateGoogleUpdater();
       UpdateStatus(UPGRADE_STARTED, GOOGLE_UPDATE_NO_ERROR, string16());
       // Specify true to upgrade now.
       google_updater_->CheckForUpdate(true, GetElevationParent());
       return;
     }
     case UPGRADE_ALREADY_UP_TO_DATE: {
       // Google Update reported that Chrome is up-to-date.
       // To confirm the updated version is running, the reading
       // must be done on the file thread. The rest of this case
       // will be handled within GotInstalledVersion.
@@ skipping 47 matching lines @@
   if (!version.IsValid() || version.CompareTo(running_version) <= 0) {
     content::RecordAction(
         UserMetricsAction("UpgradeCheck_AlreadyUpToDate"));
     callback_.Run(UPDATED, 0, string16());
   } else {
     content::RecordAction(UserMetricsAction("UpgradeCheck_AlreadyUpgraded"));
     callback_.Run(NEARLY_UPDATED, 0, string16());
   }
 }
 
-void VersionUpdaterWin::SetGoogleUpdater() {
+void VersionUpdaterWin::CreateGoogleUpdater() {
+  ClearGoogleUpdater();
   google_updater_ = new GoogleUpdate();
   google_updater_->set_status_listener(this);
 }
 
+void VersionUpdaterWin::ClearGoogleUpdater() {
+  if (google_updater_) {
+    google_updater_->set_status_listener(NULL);
+    google_updater_ = NULL;
+  }
+}
+
 BOOL CALLBACK WindowEnumeration(HWND window, LPARAM param) {
   if (IsWindowVisible(window)) {
     HWND* returned_window = reinterpret_cast<HWND*>(param);
     *returned_window = window;
     return FALSE;
   }
   return TRUE;
 }
 
 HWND VersionUpdaterWin::GetElevationParent() {
@@ skipping 10 matching lines @@
                          << GetCurrentThreadId();
 #endif
   return window;
 }
 
 }  // namespace
 
 VersionUpdater* VersionUpdater::Create() {
   return new VersionUpdaterWin;
 }