Cast: Fix crash in udp_transport

media/cast/net/udp_transport.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "media/cast/net/udp_transport.h"
 
 #include <algorithm>
 #include <string>
 
 #include "base/bind.h"
@@ skipping 48 matching lines @@
       weak_factory_(this) {
   DCHECK(!IsEmpty(local_end_point) || !IsEmpty(remote_end_point));
 }
 
 UdpTransport::~UdpTransport() {}
 
 void UdpTransport::StartReceiving(
     const PacketReceiverCallbackWithStatus& packet_receiver) {
   DCHECK(io_thread_proxy_->RunsTasksOnCurrentThread());
 
+  if (!udp_socket_) {
+    status_callback_.Run(TRANSPORT_SOCKET_ERROR);
+    return;
+  }
+
   packet_receiver_ = packet_receiver;
   udp_socket_->SetMulticastLoopbackMode(true);
   if (!IsEmpty(local_addr_)) {
     if (udp_socket_->Open(local_addr_.GetFamily()) < 0 ||
         udp_socket_->AllowAddressReuse() < 0 ||
         udp_socket_->Bind(local_addr_) < 0) {
       udp_socket_->Close();
+      udp_socket_.reset();
       status_callback_.Run(TRANSPORT_SOCKET_ERROR);
       LOG(ERROR) << "Failed to bind local address.";
       return;
     }
   } else if (!IsEmpty(remote_addr_)) {
     if (udp_socket_->Open(remote_addr_.GetFamily()) < 0 ||
         udp_socket_->AllowAddressReuse() < 0 ||
         udp_socket_->Connect(remote_addr_) < 0) {
       udp_socket_->Close();
+      udp_socket_.reset();
       status_callback_.Run(TRANSPORT_SOCKET_ERROR);
       LOG(ERROR) << "Failed to connect to remote address.";
       return;
     }
     client_connected_ = true;
   } else {
     NOTREACHED() << "Either local or remote address has to be defined.";
   }
   if (udp_socket_->SetSendBufferSize(send_buffer_size_) != net::OK) {
     LOG(WARNING) << "Failed to set socket send buffer size.";
   }
 
   ScheduleReceiveNextPacket();
 }
 
 void UdpTransport::StopReceiving() {
   DCHECK(io_thread_proxy_->RunsTasksOnCurrentThread());
   packet_receiver_ = PacketReceiverCallbackWithStatus();
 }
 
 
 void UdpTransport::SetDscp(net::DiffServCodePoint dscp) {
   DCHECK(io_thread_proxy_->RunsTasksOnCurrentThread());
   next_dscp_value_ = dscp;
 }
 
 #if defined(OS_WIN)
 void UdpTransport::UseNonBlockingIO() {
   DCHECK(io_thread_proxy_->RunsTasksOnCurrentThread());
+  if (!udp_socket_)
+    return;
   udp_socket_->UseNonBlockingIO();
 }
 #endif
 
 void UdpTransport::ScheduleReceiveNextPacket() {
   DCHECK(io_thread_proxy_->RunsTasksOnCurrentThread());
   if (!packet_receiver_.is_null() && !receive_pending_) {
     receive_pending_ = true;
     io_thread_proxy_->PostTask(FROM_HERE,
                                base::Bind(&UdpTransport::ReceiveNextPacket,
                                           weak_factory_.GetWeakPtr(),
                                           net::ERR_IO_PENDING));
   }
 }
 
 void UdpTransport::ReceiveNextPacket(int length_or_status) {
   DCHECK(io_thread_proxy_->RunsTasksOnCurrentThread());
 
   if (packet_receiver_.is_null())
     return;
+  if (!udp_socket_)
+    return;
 
   // Loop while UdpSocket is delivering data synchronously.  When it responds
   // with a "pending" status, break and expect this method to be called back in
   // the future when a packet is ready.
   while (true) {
     if (length_or_status == net::ERR_IO_PENDING) {
       next_packet_.reset(new Packet(kMaxPacketSize));
       recv_buf_ = new net::WrappedIOBuffer(
           reinterpret_cast<char*>(&next_packet_->front()));
       length_or_status =
@@ skipping 36 matching lines @@
     } else {
       next_packet_->resize(length_or_status);
       packet_receiver_.Run(next_packet_.Pass());
     }
     length_or_status = net::ERR_IO_PENDING;
   }
 }
 
 bool UdpTransport::SendPacket(PacketRef packet, const base::Closure& cb) {
   DCHECK(io_thread_proxy_->RunsTasksOnCurrentThread());
+  if (!udp_socket_)
+    return true;
 
   // Increase byte count no matter the packet was sent or dropped.
   bytes_sent_ += packet->data.size();
 
   DCHECK(!send_pending_);
   if (send_pending_) {
     VLOG(1) << "Cannot send because of pending IO.";
     return true;
   }
 
@@ skipping 60 matching lines @@
   }
   ScheduleReceiveNextPacket();
 
   if (!cb.is_null()) {
     cb.Run();
   }
 }
 
 }  // namespace cast
 }  // namespace media