IndexedDB: Fixed cursor/blob use-after-free bug

content/browser/indexed_db/indexed_db_callbacks.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/indexed_db/indexed_db_callbacks.h"
 
 #include <algorithm>
 
 #include "base/guid.h"
 #include "base/metrics/histogram.h"
@@ skipping 210 matching lines @@
 }
 
 static std::string CreateBlobData(
     const IndexedDBBlobInfo& blob_info,
     scoped_refptr<IndexedDBDispatcherHost> dispatcher_host,
     storage::BlobStorageContext* blob_storage_context,
     base::TaskRunner* task_runner) {
   std::string uuid = blob_info.uuid();
   if (!uuid.empty()) {
     // We're sending back a live blob, not a reference into our backing store.
-    scoped_ptr<storage::BlobDataHandle> blob_data_handle(
-        blob_storage_context->GetBlobDataFromUUID(uuid));
-    dispatcher_host->HoldBlobDataHandle(uuid, blob_data_handle.Pass());
+    if (!dispatcher_host->IncrementBlobDataIfHeld(uuid)) {

[jsbell, 2014/12/04 00:18:16]

Can we just make the HoldBlobDataHandle API take the uuid and mint a
BlobDataHandle if necessary?

[cmumford, 2014/12/04 18:00:29]

Done.

+      scoped_ptr<storage::BlobDataHandle> blob_data_handle(
+          blob_storage_context->GetBlobDataFromUUID(uuid));
+      dispatcher_host->HoldBlobDataHandle(uuid, blob_data_handle.Pass());
+    }
     return uuid;
   }
   scoped_refptr<ShareableFileReference> shareable_file =
       ShareableFileReference::Get(blob_info.file_path());
   if (!shareable_file.get()) {
     shareable_file = ShareableFileReference::GetOrCreate(
         blob_info.file_path(),
         ShareableFileReference::DONT_DELETE_ON_FINAL_RELEASE,
         task_runner);
     if (!blob_info.release_callback().is_null())
       shareable_file->AddFinalReleaseCallback(blob_info.release_callback());
   }
 
   uuid = base::GenerateGUID();
   scoped_refptr<storage::BlobData> blob_data = new storage::BlobData(uuid);
   blob_data->set_content_type(base::UTF16ToUTF8(blob_info.type()));
   blob_data->AppendFile(
       blob_info.file_path(), 0, blob_info.size(), blob_info.last_modified());
   scoped_ptr<storage::BlobDataHandle> blob_data_handle(

[jsbell, 2014/12/04 00:18:16]

Similarly, this BlobDataHandle is dropped if there's a matching UUID... but
since it's a new UUID that's never the case. So we could let the
HoldBlobDataHandle() do the work.

We could rename the methods to HoldBlobData(uuid)/DropBlobData(uuid)

[cmumford, 2014/12/04 18:00:29]

Done.

       blob_storage_context->AddFinishedBlob(blob_data.get()));
   dispatcher_host->HoldBlobDataHandle(uuid, blob_data_handle.Pass());
 
   return uuid;
 }
 
 static bool CreateAllBlobs(
     const std::vector<IndexedDBBlobInfo>& blob_info,
     std::vector<IndexedDBMsg_BlobOrFileInfo>* blob_or_file_info,
     scoped_refptr<IndexedDBDispatcherHost> dispatcher_host) {
@@ skipping 338 matching lines @@
       ipc_thread_id_, ipc_callbacks_id_));
   dispatcher_host_ = NULL;
 }
 
 void IndexedDBCallbacks::SetConnectionOpenStartTime(
     const base::TimeTicks& start_time) {
   connection_open_start_time_ = start_time;
 }
 
 }  // namespace content