IndexedDB: Fixed cursor/blob use-after-free bug

content/browser/indexed_db/indexed_db_dispatcher_host.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/indexed_db/indexed_db_dispatcher_host.h"
 
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/files/file_path.h"
+#include "base/guid.h"
 #include "base/memory/scoped_vector.h"
 #include "base/process/process.h"
 #include "base/stl_util.h"
 #include "base/strings/utf_string_conversions.h"
 #include "content/browser/child_process_security_policy_impl.h"
 #include "content/browser/indexed_db/indexed_db_callbacks.h"
 #include "content/browser/indexed_db/indexed_db_connection.h"
 #include "content/browser/indexed_db/indexed_db_context_impl.h"
 #include "content/browser/indexed_db/indexed_db_cursor.h"
 #include "content/browser/indexed_db/indexed_db_database_callbacks.h"
@@ skipping 42 matching lines @@
       request_context_(request_context),
       indexed_db_context_(indexed_db_context),
       blob_storage_context_(blob_storage_context),
       database_dispatcher_host_(new DatabaseDispatcherHost(this)),
       cursor_dispatcher_host_(new CursorDispatcherHost(this)),
       ipc_process_id_(ipc_process_id) {
   DCHECK(indexed_db_context_.get());
 }
 
 IndexedDBDispatcherHost::~IndexedDBDispatcherHost() {
-  STLDeleteValues(&blob_data_handle_map_);
+  for (auto& iter : blob_data_handle_map_)
+    delete iter.second.first;
 }
 
 void IndexedDBDispatcherHost::OnChannelConnected(int32 peer_pid) {
   BrowserMessageFilter::OnChannelConnected(peer_pid);
 
   if (request_context_getter_.get()) {
     DCHECK(!request_context_);
     request_context_ = request_context_getter_->GetURLRequestContext();
     request_context_getter_ = NULL;
     DCHECK(request_context_);
@@ skipping 28 matching lines @@
   // Note that we explicitly separate CloseAll() from destruction of the
   // DatabaseDispatcherHost, since CloseAll() can invoke callbacks which need to
   // be dispatched through database_dispatcher_host_.
   database_dispatcher_host_->CloseAll();
   database_dispatcher_host_.reset();
   cursor_dispatcher_host_.reset();
 }
 
 base::TaskRunner* IndexedDBDispatcherHost::OverrideTaskRunnerForMessage(
     const IPC::Message& message) {
-  if (IPC_MESSAGE_CLASS(message) == IndexedDBMsgStart &&
-      message.type() != IndexedDBHostMsg_DatabasePut::ID)
-    return indexed_db_context_->TaskRunner();
-  return NULL;
+  if (IPC_MESSAGE_CLASS(message) != IndexedDBMsgStart)
+    return NULL;
+
+  switch (message.type()) {
+    case IndexedDBHostMsg_DatabasePut::ID:
+    case IndexedDBHostMsg_AckReceivedBlobs::ID:
+      return NULL;
+    default:
+      return indexed_db_context_->TaskRunner();
+  }
 }
 
 bool IndexedDBDispatcherHost::OnMessageReceived(const IPC::Message& message) {
   if (IPC_MESSAGE_CLASS(message) != IndexedDBMsgStart)
     return false;
 
   DCHECK(indexed_db_context_->TaskRunner()->RunsTasksOnCurrentThread() ||
-         message.type() == IndexedDBHostMsg_DatabasePut::ID);
+         (message.type() == IndexedDBHostMsg_DatabasePut::ID ||
+          message.type() == IndexedDBHostMsg_AckReceivedBlobs::ID));
 
   bool handled = database_dispatcher_host_->OnMessageReceived(message) ||
                  cursor_dispatcher_host_->OnMessageReceived(message);
 
   if (!handled) {
     handled = true;
     IPC_BEGIN_MESSAGE_MAP(IndexedDBDispatcherHost, message)
       IPC_MESSAGE_HANDLER(IndexedDBHostMsg_FactoryGetDatabaseNames,
                           OnIDBFactoryGetDatabaseNames)
       IPC_MESSAGE_HANDLER(IndexedDBHostMsg_FactoryOpen, OnIDBFactoryOpen)
@@ skipping 59 matching lines @@
     int64 host_transaction_id) {
   return host_transaction_id & 0xffffffff;
 }
 
 // static
 uint32 IndexedDBDispatcherHost::TransactionIdToProcessId(
     int64 host_transaction_id) {
   return (host_transaction_id >> 32) & 0xffffffff;
 }
 
-void IndexedDBDispatcherHost::HoldBlobDataHandle(
-    const std::string& uuid,
-    scoped_ptr<storage::BlobDataHandle> blob_data_handle) {
+std::string IndexedDBDispatcherHost::HoldBlobData(
+    const IndexedDBBlobInfo& blob_info) {
+  DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
+  std::string uuid = blob_info.uuid();
+  storage::BlobStorageContext* context = blob_storage_context_->context();
+  scoped_ptr<storage::BlobDataHandle> blob_data_handle;
+  if (uuid.empty()) {
+    uuid = base::GenerateGUID();
+    scoped_refptr<storage::BlobData> blob_data = new storage::BlobData(uuid);
+    blob_data->set_content_type(base::UTF16ToUTF8(blob_info.type()));
+    blob_data->AppendFile(blob_info.file_path(), 0, blob_info.size(),
+                          blob_info.last_modified());
+    blob_data_handle = context->AddFinishedBlob(blob_data.get());
+  } else {
+    auto iter = blob_data_handle_map_.find(uuid);
+    if (iter != blob_data_handle_map_.end()) {
+      iter->second.second += 1;
+      return uuid;
+    }
+    blob_data_handle = context->GetBlobDataFromUUID(uuid);
+  }
+
   DCHECK(!ContainsKey(blob_data_handle_map_, uuid));
-  blob_data_handle_map_[uuid] = blob_data_handle.release();
+  blob_data_handle_map_[uuid] =
+      std::pair<storage::BlobDataHandle*, int>(blob_data_handle.release(), 1);

[jsbell, 2014/12/04 18:13:42]

Can you use std::make_pair here?

[cmumford, 2014/12/04 18:17:52]

Done.

+  return uuid;
 }
 
-void IndexedDBDispatcherHost::DropBlobDataHandle(const std::string& uuid) {
+void IndexedDBDispatcherHost::DropBlobData(const std::string& uuid) {
+  DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
   BlobDataHandleMap::iterator iter = blob_data_handle_map_.find(uuid);
   if (iter != blob_data_handle_map_.end()) {
-    delete iter->second;
-    blob_data_handle_map_.erase(iter);
+    DCHECK_GE(iter->second.second, 1);
+    if (iter->second.second == 1) {
+      delete iter->second.first;
+      blob_data_handle_map_.erase(iter);
+    } else {
+      iter->second.second -= 1;
+    }
   } else {
     DLOG(FATAL) << "Failed to find blob UUID in map:" << uuid;
   }
 }
 
 IndexedDBCursor* IndexedDBDispatcherHost::GetCursorFromId(int32 ipc_cursor_id) {
   DCHECK(indexed_db_context_->TaskRunner()->RunsTasksOnCurrentThread());
   return cursor_dispatcher_host_->map_.Lookup(ipc_cursor_id);
 }
 
@@ skipping 101 matching lines @@
 // OnPutHelper exists only to allow us to hop threads while holding a reference
 // to the IndexedDBDispatcherHost.
 void IndexedDBDispatcherHost::OnPutHelper(
     const IndexedDBHostMsg_DatabasePut_Params& params,
     std::vector<storage::BlobDataHandle*> handles) {
   database_dispatcher_host_->OnPut(params, handles);
 }
 
 void IndexedDBDispatcherHost::OnAckReceivedBlobs(
     const std::vector<std::string>& uuids) {
-  DCHECK(indexed_db_context_->TaskRunner()->RunsTasksOnCurrentThread());
+  DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
   for (const auto& uuid : uuids)
-    DropBlobDataHandle(uuid);
+    DropBlobData(uuid);
 }
 
 void IndexedDBDispatcherHost::FinishTransaction(int64 host_transaction_id,
                                                 bool committed) {
   DCHECK(indexed_db_context_->TaskRunner()->RunsTasksOnCurrentThread());
   if (!database_dispatcher_host_)
     return;
   TransactionIDToURLMap& transaction_url_map =
       database_dispatcher_host_->transaction_url_map_;
   TransactionIDToSizeMap& transaction_size_map =
@@ skipping 88 matching lines @@
     IndexedDBConnection* connection = map_.Lookup(iter.first);
     if (connection && connection->IsConnected()) {
       connection->Close();
       parent_->Context()->ConnectionClosed(iter.second, connection);
     }
   }
 }
 
 bool IndexedDBDispatcherHost::DatabaseDispatcherHost::OnMessageReceived(
     const IPC::Message& message) {
-
   DCHECK(
-      (message.type() == IndexedDBHostMsg_DatabasePut::ID) ||
+      (message.type() == IndexedDBHostMsg_DatabasePut::ID ||
+       message.type() == IndexedDBHostMsg_AckReceivedBlobs::ID) ||
       parent_->indexed_db_context_->TaskRunner()->RunsTasksOnCurrentThread());
 
   bool handled = true;
   IPC_BEGIN_MESSAGE_MAP(
       IndexedDBDispatcherHost::DatabaseDispatcherHost, message)
     IPC_MESSAGE_HANDLER(IndexedDBHostMsg_DatabaseCreateObjectStore,
                         OnCreateObjectStore)
     IPC_MESSAGE_HANDLER(IndexedDBHostMsg_DatabaseDeleteObjectStore,
                         OnDeleteObjectStore)
     IPC_MESSAGE_HANDLER(IndexedDBHostMsg_DatabaseCreateTransaction,
@@ skipping 517 matching lines @@
 }
 
 void IndexedDBDispatcherHost::CursorDispatcherHost::OnDestroyed(
     int32 ipc_object_id) {
   DCHECK(
       parent_->indexed_db_context_->TaskRunner()->RunsTasksOnCurrentThread());
   parent_->DestroyObject(&map_, ipc_object_id);
 }
 
 }  // namespace content