[android_webview] Fix UAF in request interception code.

android_webview/browser/aw_request_interceptor.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "android_webview/browser/aw_request_interceptor.h"
 
 #include "android_webview/browser/aw_contents_io_thread_client.h"
 #include "android_webview/browser/intercepted_request_data.h"
 #include "base/android/jni_string.h"
 #include "base/memory/scoped_ptr.h"
@@ skipping 10 matching lines @@
 using content::ResourceRequestInfo;
 
 namespace android_webview {
 
 namespace {
 
 const void* kURLRequestUserDataKey = &kURLRequestUserDataKey;
 
 class URLRequestUserData : public base::SupportsUserData::Data {
  public:
-    URLRequestUserData(
-        scoped_ptr<InterceptedRequestData> intercepted_request_data)
-        : intercepted_request_data_(intercepted_request_data.Pass()) {
-    }
+  URLRequestUserData(scoped_refptr<InterceptedRequestData::Holder> holder)
+      : holder_(holder) {}
 
-    static URLRequestUserData* Get(net::URLRequest* request) {
-      return reinterpret_cast<URLRequestUserData*>(
-          request->GetUserData(kURLRequestUserDataKey));
-    }
+  static URLRequestUserData* Get(net::URLRequest* request) {
+    return reinterpret_cast<URLRequestUserData*>(
+        request->GetUserData(kURLRequestUserDataKey));
+  }
 
-    const InterceptedRequestData* intercepted_request_data() const {
-      return intercepted_request_data_.get();
-    }
+  scoped_refptr<InterceptedRequestData::Holder> holder() const {
+    return holder_;
+  }
 
  private:
-  scoped_ptr<InterceptedRequestData> intercepted_request_data_;
+  scoped_refptr<InterceptedRequestData::Holder> holder_;
 };
 
 } // namespace
 
 AwRequestInterceptor::AwRequestInterceptor() {
 }
 
 AwRequestInterceptor::~AwRequestInterceptor() {
 }
 
@@ skipping 27 matching lines @@
   // as it is possible for the Interceptor chain to be invoked more than once
   // (in which case we don't want to query the embedder multiple times).
   URLRequestUserData* user_data = URLRequestUserData::Get(request);
 
   if (!user_data) {
     // To ensure we only query the embedder once, we rely on the fact that the
     // user_data object will be created and attached to the URLRequest after a
     // call to QueryForInterceptedRequestData is made (regardless of whether
     // the result of that call is a valid InterceptedRequestData* pointer or
     // NULL.
-    user_data = new URLRequestUserData(
-        QueryForInterceptedRequestData(request->url(), request));
+    scoped_ptr<InterceptedRequestData> data =
+        QueryForInterceptedRequestData(request->url(), request);
+    scoped_refptr<InterceptedRequestData::Holder> holder;
+    if (data) {
+      holder = new InterceptedRequestData::Holder();
+      holder->data = data.Pass();
+    }
+    user_data = new URLRequestUserData(holder);
     request->SetUserData(kURLRequestUserDataKey, user_data);
   }
 
-  const InterceptedRequestData* intercepted_request_data =
-      user_data->intercepted_request_data();
-
-  if (!intercepted_request_data)
+  if (!user_data->holder().get())
     return NULL;
-  return intercepted_request_data->CreateJobFor(request, network_delegate);
+  return InterceptedRequestData::CreateJobFor(
+      user_data->holder(), request, network_delegate);
 }
 
 } // namespace android_webview