Prevent URLFetcher::AppendChunkedData from dereferencing NULL pointers.

net/base/chunked_upload_data_stream.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/chunked_upload_data_stream.h"
 
 #include "base/logging.h"
 #include "net/base/io_buffer.h"
 #include "net/base/net_errors.h"
 
 namespace net {
 
+ChunkedUploadDataStream::Writer::~Writer() {}
+
+bool ChunkedUploadDataStream::Writer::AppendData(const char* data,
+                                                 int data_len,
+                                                 bool is_done) {
+  if (!upload_data_stream_)

[mef, 2016/03/03 16:49:32]

Could this be racy if upload_data_stream_ is deleted on the network thread while
AppendData is running on ChunkedUpload thread?

[mmenke, 2016/03/03 17:04:45]

Neither of these classes is threadsafe - this is all happening on the network
thread.

[mef, 2016/03/08 17:19:22]

Ack, for some reason I thought that these are called on different thread. Thanks
for bearing with me!

[mmenke, 2016/03/09 17:27:15]

The URLFetcherCore runs on two threads, but all it does on the non-network-stack
thread is set state before the request starts.  Its methods that are meant to be
called after the request starts just post messages over to the network thread.

Everything else lives only on the network thread, with the exception of the
URLFetcher, which is used strictly on the consumers thread (Which may be the
network thread, or may not).

+    return false;
+  upload_data_stream_->AppendData(data, data_len, is_done);
+  return true;
+}
+
+ChunkedUploadDataStream::Writer::Writer(
+    base::WeakPtr<ChunkedUploadDataStream> upload_data_stream)
+    : upload_data_stream_(upload_data_stream) {}
+
 ChunkedUploadDataStream::ChunkedUploadDataStream(int64_t identifier)
     : UploadDataStream(true, identifier),
       read_index_(0),
       read_offset_(0),
       all_data_appended_(false),
-      read_buffer_len_(0) {
+      read_buffer_len_(0),
+      weak_factory_(this) {}
+
+ChunkedUploadDataStream::~ChunkedUploadDataStream() {
 }
 
-ChunkedUploadDataStream::~ChunkedUploadDataStream() {
+scoped_ptr<ChunkedUploadDataStream::Writer>
+ChunkedUploadDataStream::CreateWriter() {
+  return make_scoped_ptr(new Writer(weak_factory_.GetWeakPtr()));
 }
 
 void ChunkedUploadDataStream::AppendData(
     const char* data, int data_len, bool is_done) {
   DCHECK(!all_data_appended_);
   DCHECK(data_len > 0 || is_done);
   if (data_len > 0) {
     DCHECK(data);
     upload_data_.push_back(
         make_scoped_ptr(new std::vector<char>(data, data + data_len)));
@@ skipping 61 matching lines @@
   // ERR_IO_PENDING. The read will be completed in the next call to AppendData.
   if (bytes_read == 0 && !all_data_appended_)
     return ERR_IO_PENDING;
 
   if (read_index_ == upload_data_.size() && all_data_appended_)
     SetIsFinalChunk();
   return bytes_read;
 }
 
 }  // namespace net