Prevent URLFetcher::AppendChunkedData from dereferencing NULL pointers.

net/base/chunked_upload_data_stream.h

Index: net/base/chunked_upload_data_stream.h
diff --git a/net/base/chunked_upload_data_stream.h b/net/base/chunked_upload_data_stream.h
index 7b5e2dfecb618393d8a8bc50f05f4739cde5ea08..d93ae5f72c823268e8389195d8505afd38bf0fe9 100644
--- a/net/base/chunked_upload_data_stream.h
+++ b/net/base/chunked_upload_data_stream.h
@@ -12,6 +12,8 @@
 
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
+#include "base/memory/scoped_ptr.h"
+#include "base/memory/weak_ptr.h"
 #include "net/base/completion_callback.h"
 #include "net/base/net_export.h"
 #include "net/base/upload_data_stream.h"
@@ -25,14 +27,47 @@ class IOBuffer;
 // seekable data, due to this buffering behavior.
 class NET_EXPORT ChunkedUploadDataStream : public UploadDataStream {
  public:
+  // Utility class that allows writing data to a particular
+  // ChunkedUploadDataStream. It's needed because URLRequest owns the
+  // ChunkedUploadDataStream and manages its lifetime (And can delete it without
+  // warning, if failures are intercepted and then redirected), but higher level
+  // code is responsible for writing to the ChunkedUploadDataStream.
+  //
+  // The writer may only be used on the ChunkedUploadDataStream's thread.
+  class NET_EXPORT Writer {
+   public:
+    ~Writer();
+
+    // Adds data to the stream. |is_done| should be true if this is the last
+    // data to be appended. |data_len| must not be 0 unless |is_done| is true.
+    // Once called with |is_done| being true, must never be called again.
+    // Returns true if write succeeded, false if it failed (Generally because
+    // the underlying ChunkedUploadDataStream was destroyed).
+    bool AppendData(const char* data, int data_len, bool is_done);
+
+   private:
+    friend class ChunkedUploadDataStream;
+
+    explicit Writer(base::WeakPtr<ChunkedUploadDataStream> upload_data_stream);
+
+    const base::WeakPtr<ChunkedUploadDataStream> upload_data_stream_;
+
+    DISALLOW_COPY_AND_ASSIGN(Writer);
+  };
+
   explicit ChunkedUploadDataStream(int64_t identifier);
 
   ~ChunkedUploadDataStream() override;
 
+  // Creates a Writer for appending data to |this|.
+  scoped_ptr<Writer> CreateWriter();
+
   // Adds data to the stream. |is_done| should be true if this is the last
   // data to be appended. |data_len| must not be 0 unless |is_done| is true.
   // Once called with |is_done| being true, must never be called again.
   // TODO(mmenke):  Consider using IOBuffers instead, to reduce data copies.
+  // TODO(mmenke):  Consider making private, and having all consumers use
+  //     Writers.
   void AppendData(const char* data, int data_len, bool is_done);
 
  private:
@@ -57,6 +92,8 @@ class NET_EXPORT ChunkedUploadDataStream : public UploadDataStream {
   scoped_refptr<IOBuffer> read_buffer_;
   int read_buffer_len_;
 
+  base::WeakPtrFactory<ChunkedUploadDataStream> weak_factory_;
+
   DISALLOW_COPY_AND_ASSIGN(ChunkedUploadDataStream);
 };