Fix UAF on singleton service instances

services/service_manager/service_manager.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "services/service_manager/service_manager.h"
 
 #include <stdint.h>
 
 #include <utility>
 
@@ skipping 128 matching lines @@
     // Deletes |child|.
     children_.erase(it);
   }
 
   bool ConnectToService(std::unique_ptr<ConnectParams>* connect_params) {
     if (!service_.is_bound())
       return false;
 
     std::unique_ptr<ConnectParams> params(std::move(*connect_params));
     if (!params->connect_callback().is_null()) {
-        params->connect_callback().Run(mojom::ConnectResult::SUCCEEDED,
-                                       identity_.user_id());
+      params->connect_callback().Run(mojom::ConnectResult::SUCCEEDED,
+                                     identity_.user_id());
     }
 
     InterfaceProviderSpecMap specs;
     Instance* source = service_manager_->GetExistingInstance(params->source());
     if (source)
       specs = source->interface_provider_specs_;
 
     pending_service_connections_++;
     service_->OnConnect(ServiceInfo(params->source(), specs),
                         params->TakeRemoteInterfaces(),
@@ skipping 469 matching lines @@
   mojom::Resolver* resolver = resolver_ptr.get();
   identity_to_resolver_[identity] = std::move(resolver_ptr);
   return resolver;
 }
 
 void ServiceManager::OnInstanceError(Instance* instance) {
   // We never clean up the ServiceManager's own instance.
   if (instance == service_manager_instance_)
     return;
 
-  const Identity identity = instance->identity();
-  identity_to_instance_.erase(identity);
-
+  EraseInstanceIdentity(instance);
   if (instance->parent()) {
     // Deletes |instance|.
     instance->parent()->RemoveChild(instance);
   } else {
     auto it = root_instances_.find(instance);
     DCHECK(it != root_instances_.end());
 
     // Deletes |instance|.
     root_instances_.erase(it);
   }
 }
 
 void ServiceManager::OnInstanceUnreachable(Instance* instance) {
   // If an Instance becomes unreachable, new connection requests for this
   // identity will elicit a new Instance instantiation. The unreachable instance
   // remains alive.
-  identity_to_instance_.erase(instance->identity());
+  EraseInstanceIdentity(instance);
 }
 
 void ServiceManager::OnInstanceStopped(const Identity& identity) {
   listeners_.ForAllPtrs([identity](mojom::ServiceManagerListener* listener) {
     listener->OnServiceStopped(identity);
   });
   if (!instance_quit_callback_.is_null())
     instance_quit_callback_.Run(identity);
 }
 
@@ skipping 38 matching lines @@
     for (auto entry : identity_to_instance_) {
       if (entry.first.name() == identity.name() &&
           entry.first.instance() == identity.instance()) {
         return entry.second;
       }
     }
   }
   return nullptr;
 }
 
+void ServiceManager::EraseInstanceIdentity(Instance* instance) {
+  const Identity& identity = instance->identity();
+
+  auto it = identity_to_instance_.find(identity);
+  if (it != identity_to_instance_.end()) {
+    identity_to_instance_.erase(it);
+    return;
+  }
+
+  if (singletons_.find(identity.name()) != singletons_.end()) {
+    singletons_.erase(identity.name());
+    for (auto it = identity_to_instance_.begin();
+         it != identity_to_instance_.end(); ++it) {
+      if (it->first.name() == identity.name() &&
+          it->first.instance() == identity.instance()) {
+        identity_to_instance_.erase(it);
+        return;
+      }
+    }
+  }
+}
+
 void ServiceManager::NotifyServiceStarted(const Identity& identity,
                                           base::ProcessId pid) {
   listeners_.ForAllPtrs(
       [identity, pid](mojom::ServiceManagerListener* listener) {
         listener->OnServiceStarted(identity, pid);
       });
 }
 
 void ServiceManager::NotifyServiceFailedToStart(const Identity& identity) {
   listeners_.ForAllPtrs(
@@ skipping 208 matching lines @@
   // Now that the instance has a Service, we can connect to it.
   bool connected = instance->ConnectToService(&params);
   DCHECK(connected);
 }
 
 base::WeakPtr<ServiceManager> ServiceManager::GetWeakPtr() {
   return weak_ptr_factory_.GetWeakPtr();
 }
 
 }  // namespace service_manager