Fix NULL dereference if a extension subpermission is removed.

extensions/common/permissions/media_galleries_permission.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/common/permissions/media_galleries_permission.h"
 
 #include <set>
 #include <string>
 
 #include "base/logging.h"
@@ skipping 42 matching lines @@
                              MediaGalleriesPermission>(info) {
 }
 
 MediaGalleriesPermission::~MediaGalleriesPermission() {
 }
 
 bool MediaGalleriesPermission::FromValue(
     const base::Value* value,
     std::string* error,
     std::vector<std::string>* unhandled_permissions) {
-  std::vector<std::string> unhandled_sub_permissions;
-  if (!SetDisjunctionPermission<MediaGalleriesPermissionData,
-                                MediaGalleriesPermission>::FromValue(
-                                    value, error, &unhandled_sub_permissions)) {
-    unhandled_permissions->insert(unhandled_permissions->end(),
-                                  unhandled_sub_permissions.begin(),
-                                  unhandled_sub_permissions.end());
+  size_t unhandled_permissions_count = 0;
+  if (unhandled_permissions)
+    unhandled_permissions_count = unhandled_permissions->size();
+  bool parsed_ok =
+      SetDisjunctionPermission<MediaGalleriesPermissionData,
+                               MediaGalleriesPermission>::FromValue(
+                                   value, error, unhandled_permissions);
+  if (unhandled_permissions) {

[Yoyo Zhou, 2014/04/14 23:21:53]

This also changes the behavior - I think it's more correct the way you have it.

+    for (size_t i = unhandled_permissions_count;
+         i < unhandled_permissions->size();
+         i++) {
+      (*unhandled_permissions)[i] =
+          "{\"mediaGalleries\": [" + (*unhandled_permissions)[i] + "]}";
+    }
+  }
+  if (!parsed_ok)
     return false;
-  }
-
-  for (size_t i = 0; i < unhandled_sub_permissions.size(); i++) {
-    unhandled_permissions->push_back(
-        "{\"mediaGalleries\": [" + unhandled_sub_permissions[i] + "]}");
-  }
 
   bool has_read = false;
   bool has_copy_to = false;
   bool has_delete = false;
   for (std::set<MediaGalleriesPermissionData>::const_iterator it =
       data_set_.begin(); it != data_set_.end(); ++it) {
     if (it->permission() == kAllAutoDetectedPermission ||
         it->permission() == kScanPermission) {
       continue;
     }
@@ skipping 72 matching lines @@
   }
   if (has_delete) {
     result.push_back(PermissionMessage(
         PermissionMessage::kMediaGalleriesAllGalleriesDelete,
         base::string16()));
   }
   return result;
 }
 
 }  // namespace extensions