<chromium> Cherry-pick fix for CVE-2015-6767

AppCache: Use WeakPtr<> to fix a potential uaf bug.

BUG=554908

Review URL: https://codereview.chromium.org/1441683004

Change-Id: Ic5eb64a34a7e0d373428789b8571e6f3a2fc96e9
Reviewed-by: Michael Brüning <[email protected]>

Author: carewolf

chromium/content/browser/appcache/appcache_dispatcher_host.cc

@@ -18,7 +18,8 @@ AppCacheDispatcherHost::AppCacheDispatcherHost(
     : BrowserMessageFilter(AppCacheMsgStart),
       appcache_service_(appcache_service),
       frontend_proxy_(this),
-      process_id_(process_id) {
+      process_id_(process_id),
+      weak_factory_(this) {
 }
 
 void AppCacheDispatcherHost::OnChannelConnected(int32 peer_pid) {
@@ -27,13 +28,13 @@ void AppCacheDispatcherHost::OnChannelConnected(int32 peer_pid) {
         appcache_service_.get(), &frontend_proxy_, process_id_);
     get_status_callback_ =
         base::Bind(&AppCacheDispatcherHost::GetStatusCallback,
-                   base::Unretained(this));
+                    weak_factory_.GetWeakPtr());
     start_update_callback_ =
         base::Bind(&AppCacheDispatcherHost::StartUpdateCallback,
-                   base::Unretained(this));
+                    weak_factory_.GetWeakPtr());
     swap_cache_callback_ =
         base::Bind(&AppCacheDispatcherHost::SwapCacheCallback,
-                   base::Unretained(this));
+                    weak_factory_.GetWeakPtr());
   }
 }
 

chromium/content/browser/appcache/appcache_dispatcher_host.h

@@ -9,6 +9,7 @@
 
 #include "base/memory/ref_counted.h"
 #include "base/memory/scoped_ptr.h"
+#include "base/memory/weak_ptr.h"
 #include "base/process/process.h"
 #include "content/browser/appcache/appcache_backend_impl.h"
 #include "content/browser/appcache/appcache_frontend_proxy.h"
@@ -72,6 +73,8 @@ class AppCacheDispatcherHost : public BrowserMessageFilter {
   // The corresponding ChildProcessHost object's id().
   int process_id_;
 
+  base::WeakPtrFactory<AppCacheDispatcherHost> weak_factory_;
+
   DISALLOW_COPY_AND_ASSIGN(AppCacheDispatcherHost);
 };