Fix stack-use-after-scope in png_codec.

ui/gfx/codec/png_codec.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ui/gfx/codec/png_codec.h"
 
 #include <stdint.h>
 
 #include "base/logging.h"
 #include "base/macros.h"
@@ skipping 694 matching lines @@
       return false;
   }
 
   // Row stride should be at least as long as the length of the data.
   DCHECK(input_color_components * size.width() <= row_byte_width);
 
   png_struct* png_ptr = png_create_write_struct(PNG_LIBPNG_VER_STRING,
                                                 NULL, NULL, NULL);
   if (!png_ptr)
     return false;
+  // info_ptr should have wider lifetime scope than destroyer that access it,
+  // to avoid use-after-scope bugs.
+  png_info* info_ptr;
   PngWriteStructDestroyer destroyer(&png_ptr);

[dcheng, 2016/12/14 22:32:47]

Can we move this line down to after return false? Then we can combine
declaration + initialization of |info_ptr| (and we may as well just make
&info_ptr an argument to the ctor).

[krasin1, 2016/12/14 23:45:04]

Daniel, Nico,

I have made a simplification that can be applied to other types of Png*Destroyer
classes too (and I am fine to do the upgrade in this CL, it you feel it's worth
it).

Basically, instead of making this delicate dance inline, I have added two fields
into PngWriteStructDestroyer (and also renamed it to PngWriteStructInfo, as it
now holds png_ptr and info_ptr), and we use the fields instead of local
variables.

Do you feel that's less fragile?

-  png_info* info_ptr = png_create_info_struct(png_ptr);
+  info_ptr = png_create_info_struct(png_ptr);
   if (!info_ptr)
     return false;
   destroyer.SetInfoStruct(&info_ptr);
 
   output->clear();
 
   PngEncoderState state(output);
   bool success = DoLibpngWrite(png_ptr, info_ptr, &state,
                                size.width(), size.height(), row_byte_width,
                                input, compression_level, png_output_color_type,
@@ skipping 77 matching lines @@
 }
 
 PNGCodec::Comment::Comment(const std::string& k, const std::string& t)
     : key(k), text(t) {
 }
 
 PNGCodec::Comment::~Comment() {
 }
 
 }  // namespace gfx