Prevent URLFetcher::AppendChunkedData from dereferencing NULL pointers.

net/base/chunked_upload_data_stream.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/chunked_upload_data_stream.h"
 
 #include "base/logging.h"
 #include "net/base/io_buffer.h"
 #include "net/base/net_errors.h"
 
 namespace net {
 
+ChunkedUploadDataStream::Writer::~Writer() {}
+
+bool ChunkedUploadDataStream::Writer::AppendData(const char* data,
+                                                 int data_len,
+                                                 bool is_done) {
+  if (!upload_data_stream_)
+    return false;
+  upload_data_stream_->AppendData(data, data_len, is_done);
+  return true;
+}
+
+ChunkedUploadDataStream::Writer::Writer(
+    base::WeakPtr<ChunkedUploadDataStream> upload_data_stream)
+    : upload_data_stream_(upload_data_stream) {}
+
 ChunkedUploadDataStream::ChunkedUploadDataStream(int64_t identifier)
     : UploadDataStream(true, identifier),
       read_index_(0),
       read_offset_(0),
       all_data_appended_(false),
-      read_buffer_len_(0) {
+      read_buffer_len_(0),
+      weak_factory_(this) {}
+
+ChunkedUploadDataStream::~ChunkedUploadDataStream() {
 }
 
-ChunkedUploadDataStream::~ChunkedUploadDataStream() {
+scoped_ptr<ChunkedUploadDataStream::Writer>
+ChunkedUploadDataStream::CreateWriter() {
+  return make_scoped_ptr(new Writer(weak_factory_.GetWeakPtr()));
 }
 
 void ChunkedUploadDataStream::AppendData(
     const char* data, int data_len, bool is_done) {
   DCHECK(!all_data_appended_);
   DCHECK(data_len > 0 || is_done);
   if (data_len > 0) {
     DCHECK(data);
     upload_data_.push_back(
         make_scoped_ptr(new std::vector<char>(data, data + data_len)));
@@ skipping 61 matching lines @@
   // ERR_IO_PENDING. The read will be completed in the next call to AppendData.
   if (bytes_read == 0 && !all_data_appended_)
     return ERR_IO_PENDING;
 
   if (read_index_ == upload_data_.size() && all_data_appended_)
     SetIsFinalChunk();
   return bytes_read;
 }
 
 }  // namespace net