Fixes use-after-free bug in QUIC.

net/quic/quic_spdy_session.cc

 // Copyright (c) 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/quic/quic_spdy_session.h"
 
 #include "net/quic/quic_bug_tracker.h"
 #include "net/quic/quic_headers_stream.h"
 
 using base::StringPiece;
 using std::string;
 
 namespace net {
 
 QuicSpdySession::QuicSpdySession(QuicConnection* connection,
                                  const QuicConfig& config)
     : QuicSession(connection, config) {}
 
-QuicSpdySession::~QuicSpdySession() {}
+QuicSpdySession::~QuicSpdySession() {
+  // Set the streams' session pointers in closed and dynamic stream lists
+  // to null to avoid subsequent use of this session.
+  for (auto const& stream : *closed_streams()) {
+    static_cast<QuicSpdyStream*>(stream)->ClearSession();
+  }
+  for (auto const& kv : dynamic_streams()) {
+    static_cast<QuicSpdyStream*>(kv.second)->ClearSession();
+  }
+}
 
 void QuicSpdySession::Initialize() {
   QuicSession::Initialize();
 
   if (perspective() == Perspective::IS_SERVER) {
     set_largest_peer_created_stream_id(kHeadersStreamId);
   } else {
     QuicStreamId headers_stream_id = GetNextOutgoingStreamId();
     DCHECK_EQ(headers_stream_id, kHeadersStreamId);
   }
@@ skipping 108 matching lines @@
 
 void QuicSpdySession::OnConfigNegotiated() {
   QuicSession::OnConfigNegotiated();
   if (FLAGS_quic_disable_hpack_dynamic_table &&
       config()->HasClientSentConnectionOption(kDHDT, perspective())) {
     headers_stream_->DisableHpackDynamicTable();
   }
 }
 
 }  // namespace net