Try to fix crash in OCSP handlers.

net/ocsp/nss_ocsp.cc

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/ocsp/nss_ocsp.h"
 
 // Work around https://bugzilla.mozilla.org/show_bug.cgi?id=455424
 // until NSS 3.12.2 comes out and we update to it.
 #define Lock FOO_NSS_Lock
 #include <certt.h>
@@ skipping 62 matching lines @@
 };
 
 scoped_refptr<URLRequestContext> OCSPInitSingleton::request_context_;
 
 // Concrete class for SEC_HTTP_REQUEST_SESSION.
 class OCSPRequestSession {
  public:
   OCSPRequestSession(const GURL& url,
                      const char* http_request_method,
                      base::TimeDelta timeout);
-  ~OCSPRequestSession() {}
+  ~OCSPRequestSession();
 
   void SetPostData(const char* http_data,
                    const PRUint32 http_data_len,
                    const char* http_content_type);
 
   void AddHeader(const char* http_header_name,
                  const char* http_header_value);
 
   void Start();
   bool Started() const;
@@ skipping 36 matching lines @@
 // This class is the real guts of OCSP handlers.
 // Public methods except virtual methods of URLRequest::Delegate (On* methods)
 // run on certificate verifier thread (worker thread).
 // Virtual methods of URLRequest::Delegate and private methods run
 // on IO thread.
 class OCSPRequestSession::Core
     : public base::RefCountedThreadSafe<OCSPRequestSession::Core>,
       public URLRequest::Delegate {
  public:
   explicit Core(OCSPRequestSession* req)
-      : ocsp_req_(req),
-        url_(ocsp_req_->url()),
+      : url_(req->url()),
+        http_request_method_(req->http_request_method()),
+        timeout_(req->timeout()),
         io_loop_(Singleton<OCSPInitSingleton>::get()->io_thread()),
         request_(NULL),
         buffer_(new net::IOBuffer(kRecvBufferSize)),
         response_code_(-1),
         cv_(&lock_),
         finished_(false) {}
-  virtual ~Core() {}
+  virtual ~Core() {
+    DCHECK(!request_);
+  }
 
   void SetPostData(const char* http_data, PRUint32 http_data_len,
                    const char* http_content_type) {
     upload_content_.assign(http_data, http_data_len);
     upload_content_type_.assign(http_content_type);
   }
 
   void AddHeader(const char* http_header_name, const char* http_header_value) {
     if (!extra_request_headers_.empty())
       extra_request_headers_ += "\r\n";
@@ skipping 15 matching lines @@
     AutoLock autolock(lock_);
     return finished_;
   }
 
   void Cancel() {
     io_loop_->PostTask(FROM_HERE,
                        NewRunnableMethod(this, &Core::CancelURLRequest));
   }
 
   bool Wait() {
-    base::TimeDelta timeout = ocsp_req_->timeout();
+    base::TimeDelta timeout = timeout_;
     AutoLock autolock(lock_);
     while (!finished_) {
       base::TimeTicks last_time = base::TimeTicks::Now();
       cv_.TimedWait(timeout);
       // Check elapsed time
       base::TimeDelta elapsed_time = base::TimeTicks::Now() - last_time;
       timeout -= elapsed_time;
       if (timeout < base::TimeDelta()) {
         LOG(INFO) << "OCSP Timed out";
         if (!finished_)
@@ skipping 24 matching lines @@
     return data_;
   }
 
   // Follow rediect.
   virtual void OnReceivedRedirect(URLRequest* request,
                                   const GURL& new_url) {}
 
   virtual void OnResponseStarted(URLRequest* request) {
     DCHECK(request == request_);
     DCHECK(MessageLoopForIO::current() == io_loop_);
+
     int bytes_read = 0;
     if (request->status().is_success()) {
       response_code_ = request_->GetResponseCode();
       response_headers_ = request_->response_headers();
       response_headers_->GetMimeType(&response_content_type_);
       request_->Read(buffer_, kRecvBufferSize, &bytes_read);
     }
     OnReadCompleted(request_, bytes_read);
   }
 
@@ skipping 23 matching lines @@
     DCHECK(MessageLoopForIO::current() == io_loop_);
     DCHECK(!request_);
 
     request_ = new URLRequest(url_, this);
     request_->set_context(
         Singleton<OCSPInitSingleton>::get()->url_request_context());
     // To meet the privacy requirements of off-the-record mode.
     request_->set_load_flags(
         net::LOAD_DISABLE_CACHE|net::LOAD_DO_NOT_SAVE_COOKIES);
 
-    if (ocsp_req_->http_request_method() == "POST") {
+    if (http_request_method_ == "POST") {
       DCHECK(!upload_content_.empty());
       DCHECK(!upload_content_type_.empty());
 
       request_->set_method("POST");
       if (!extra_request_headers_.empty())
         extra_request_headers_ += "\r\n";
       StringAppendF(&extra_request_headers_,
                     "Content-Type: %s", upload_content_type_.c_str());
       request_->AppendBytesToUpload(upload_content_.data(),
                                     static_cast<int>(upload_content_.size()));
     }
     if (!extra_request_headers_.empty())
       request_->SetExtraRequestHeaders(extra_request_headers_);
 
     request_->Start();
   }
 
   void CancelURLRequest() {
     DCHECK(MessageLoopForIO::current() == io_loop_);
     if (request_) {
+      request_->Cancel();
       delete request_;
       request_ = NULL;
     }
   }
 
-  OCSPRequestSession* ocsp_req_;  // corresponding OCSP session
   GURL url_;                      // The URL we eventually wound up at
+  std::string http_request_method_;
+  base::TimeDelta timeout_;       // The timeout for OCSP
   MessageLoop* io_loop_;          // Message loop of the IO thread
   URLRequest* request_;           // The actual request this wraps
   scoped_refptr<net::IOBuffer> buffer_;  // Read buffer
   std::string extra_request_headers_;  // Extra headers for the request, if any
   std::string upload_content_;    // HTTP POST payload
   std::string upload_content_type_;  // MIME type of POST payload
 
   int response_code_;             // HTTP status code for the request
   std::string response_content_type_;
   scoped_refptr<net::HttpResponseHeaders> response_headers_;
   std::string data_;              // Results of the requst
 
   // |lock_| protects |finished_| only.
   mutable Lock lock_;
   ConditionVariable cv_;
 
   bool finished_;
 
   DISALLOW_COPY_AND_ASSIGN(Core);
 };
 
 OCSPRequestSession::OCSPRequestSession(const GURL& url,
                                        const char* http_request_method,
                                        base::TimeDelta timeout)
     : url_(url), http_request_method_(http_request_method),
       timeout_(timeout),
       ALLOW_THIS_IN_INITIALIZER_LIST(core_(new Core(this))) {
 }
 
+OCSPRequestSession::~OCSPRequestSession() {
+  core_->Cancel();
+}
+
 void OCSPRequestSession::SetPostData(const char* http_data,
                                      const PRUint32 http_data_len,
                                      const char* http_content_type) {
   core_->SetPostData(http_data, http_data_len, http_content_type);
 }
 
 void OCSPRequestSession::AddHeader(const char* http_header_name,
                                    const char* http_header_value) {
   core_->AddHeader(http_header_name, http_header_value);
 }
@@ skipping 162 matching lines @@
   DCHECK(req->Finished());
   const std::string& data = req->http_response_data();
   if (http_response_data_len && *http_response_data_len) {
     if (*http_response_data_len < data.size()) {
       LOG(ERROR) << "data size too large: " << *http_response_data_len
                  << " < " << data.size();
       *http_response_data_len = 1;
       return false;
     }
   }
-  LOG(INFO) << "OSCP response "
+  LOG(INFO) << "OCSP response "
             << " response_code=" << req->http_response_code()
             << " content_type=" << req->http_response_content_type()
             << " header=" << req->http_response_headers()
             << " data_len=" << data.size();
   if (http_response_code)
     *http_response_code = req->http_response_code();
   if (http_response_content_type)
     *http_response_content_type = req->http_response_content_type().c_str();
   if (http_response_headers)
     *http_response_headers = req->http_response_headers().c_str();
@@ skipping 69 matching lines @@
 void EnsureOCSPInit() {
   Singleton<OCSPInitSingleton>::get();
 }
 
 // This function would be called before NSS initialization.
 void SetURLRequestContextForOCSP(URLRequestContext* request_context) {
   OCSPInitSingleton::set_url_request_context(request_context);
 }
 
 }  // namespace net