Prevent URLFetcher::AppendChunkedData from dereferencing NULL pointers.

components/cronet/android/url_request_adapter.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef COMPONENTS_CRONET_ANDROID_URL_REQUEST_ADAPTER_H_
 #define COMPONENTS_CRONET_ANDROID_URL_REQUEST_ADAPTER_H_
 
 #include <jni.h>
 #include <stdint.h>
 
 #include <string>
 
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
 #include "base/memory/scoped_ptr.h"
+#include "net/base/chunked_upload_data_stream.h"
 #include "net/base/request_priority.h"
 #include "net/http/http_request_headers.h"
 #include "net/url_request/url_request.h"
 
 namespace net {
+class HttpResponseHeaders;
 class IOBufferWithSize;
-class HttpResponseHeaders;
 class UploadDataStream;
 struct RedirectInfo;
 }  // namespace net
 
 namespace cronet {
 
 class URLRequestContextAdapter;
 
 // An adapter from the JNI |UrlRequest| object and the Chromium |URLRequest|
 // object.
 class URLRequestAdapter : public net::URLRequest::Delegate {

[mef, 2016/03/03 16:49:32]

This is old API, do we need similar change for new API?

[mmenke, 2016/03/03 17:04:45]

The new API doesn't use URLRequest::AppendData, so it's fine.

  public:
   // The delegate which is called when the request finishes.
   class URLRequestAdapterDelegate
       : public base::RefCountedThreadSafe<URLRequestAdapterDelegate> {
    public:
     virtual void OnResponseStarted(URLRequestAdapter* request) = 0;
     virtual void OnBytesRead(URLRequestAdapter* request, int bytes_read) = 0;
     virtual void OnRequestFinished(URLRequestAdapter* request) = 0;
     virtual int ReadFromUploadChannel(net::IOBuffer* buf, int buf_length) = 0;
 
@@ skipping 105 matching lines @@
   bool HandleReadResult(int bytes_read);
 
   URLRequestContextAdapter* context_;
   scoped_refptr<URLRequestAdapterDelegate> delegate_;
   GURL url_;
   net::RequestPriority priority_;
   std::string method_;
   net::HttpRequestHeaders headers_;
   scoped_ptr<net::URLRequest> url_request_;
   scoped_ptr<net::UploadDataStream> upload_data_stream_;
+  scoped_ptr<net::ChunkedUploadDataStream::Writer> chunked_upload_writer_;
   scoped_refptr<net::IOBufferWithSize> read_buffer_;
   int total_bytes_read_;
   int error_code_;
   int http_status_code_;
   std::string http_status_text_;
   std::string content_type_;
   bool canceled_;
   int64_t expected_size_;
   bool chunked_upload_;
   // Indicates whether redirect has been disabled.
   bool disable_redirect_;
 
   DISALLOW_COPY_AND_ASSIGN(URLRequestAdapter);
 };
 
 }  // namespace cronet
 
 #endif  // COMPONENTS_CRONET_ANDROID_URL_REQUEST_ADAPTER_H_