Fix a potential use-after-free after JSONReader::Read.

chrome/browser/content_settings/content_settings_policy_provider.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/content_settings/content_settings_policy_provider.h"
 
 #include <string>
 #include <vector>
 
 #include "base/json/json_reader.h"
@@ skipping 335 matching lines @@
         base::JSON_ALLOW_TRAILING_COMMAS));
     if (!value || !value->IsType(base::Value::TYPE_DICTIONARY)) {
       VLOG(1) << "Ignoring invalid certificate auto select setting. Reason:"
                  " Invalid JSON object: " << pattern_filter_json;
       continue;
     }
 
     scoped_ptr<base::DictionaryValue> pattern_filter_pair(
         static_cast<base::DictionaryValue*>(value.release()));
     std::string pattern_str;
-    bool pattern_read = pattern_filter_pair->GetString("pattern", &pattern_str);
-    scoped_ptr<base::Value> cert_filter;
-    bool filter_read = pattern_filter_pair->Remove("filter", &cert_filter);
-    if (!pattern_read || !filter_read ||
-        !cert_filter->IsType(base::Value::TYPE_DICTIONARY)) {
+    bool pattern_read = pattern_filter_pair->GetStringWithoutPathExpansion(
+        "pattern", &pattern_str);
+    base::DictionaryValue* cert_filter = NULL;
+    pattern_filter_pair->GetDictionaryWithoutPathExpansion("filter",
+                                                           &cert_filter);
+    if (!pattern_read || !cert_filter) {
       VLOG(1) << "Ignoring invalid certificate auto select setting. Reason:"
                  " Missing pattern or filter.";
       continue;
     }
 
     ContentSettingsPattern pattern =
         ContentSettingsPattern::FromString(pattern_str);
     // Ignore invalid patterns.
     if (!pattern.IsValid()) {
       VLOG(1) << "Ignoring invalid certificate auto select setting:"
                  " Invalid content settings pattern: " << pattern;
       continue;
     }
 
+    // Don't pass removed values from |value|, because base::Values read with
+    // JSONReader use a shared string buffer. Instead, DeepCopy here.
     value_map->SetValue(pattern,
                         ContentSettingsPattern::Wildcard(),
                         CONTENT_SETTINGS_TYPE_AUTO_SELECT_CERTIFICATE,
                         std::string(),
-                        cert_filter.release());
+                        cert_filter->DeepCopy());
   }
 }
 
 void PolicyProvider::ReadManagedDefaultSettings() {
   for (size_t type = 0; type < arraysize(kPrefToManageType); ++type) {
     if (kPrefToManageType[type] == NULL) {
       continue;
     }
     UpdateManagedDefaultSetting(ContentSettingsType(type));
   }
@@ skipping 98 matching lines @@
     ReadManagedDefaultSettings();
   }
 
   NotifyObservers(ContentSettingsPattern(),
                   ContentSettingsPattern(),
                   CONTENT_SETTINGS_TYPE_DEFAULT,
                   std::string());
 }
 
 }  // namespace content_settings