Copy buffers in base::FileUtilProxy::{Read,Write} to avoid memory corruption.

If caller has called PPB_FileIO_Impl::Close() while a read or 
write operation is in flight, and deletes the read or write buffer, we now avoid corrupting memory. 

For Write, FileUtilProxy::Write simply copies the input buffer before passing control to the FILE thread. For Read, the caller no longer passes a buffer; instead, they are passed a const char* in the ReadCallback. 

One caller of FileUtilProxy::Read outside of PPAPI was also updated. 

BUG=70285
R=darin
Patch by Adam Klein (adamk@chromium.org)
Originally reviewed at http://codereview.chromium.org/6312040/

Review URL: http://codereview.chromium.org/6349090

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@73714 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 6 insertions, 4 deletions

diff --git a/base/file_util_proxy.h b/base/file_util_proxy.h
index b5e28c0..f2368cc 100644
--- a/base/file_util_proxy.h
+++ b/base/file_util_proxy.h
@@ -46,8 +46,11 @@ class FileUtilProxy {
                     >::Type GetFileInfoCallback;
   typedef Callback2<PlatformFileError /* error code */,
                     const std::vector<Entry>&>::Type ReadDirectoryCallback;
+  typedef Callback3<PlatformFileError /* error code */,
+                    const char* /* data */,
+                    int /* bytes read/written */>::Type ReadCallback;
   typedef Callback2<PlatformFileError /* error code */,
-                    int /* bytes read/written */>::Type ReadWriteCallback;
+                    int /* bytes written */>::Type WriteCallback;
 
   // Creates or opens a file with the given flags.  It is invalid to pass NULL
   // for the callback.
@@ -149,9 +152,8 @@ class FileUtilProxy {
       scoped_refptr<MessageLoopProxy> message_loop_proxy,
       PlatformFile file,
       int64 offset,
-      char* buffer,
       int bytes_to_read,
-      ReadWriteCallback* callback);
+      ReadCallback* callback);
 
   // Writes to a file. If |offset| is greater than the length of the file,
   // |false| is returned. On success, the file pointer is moved to position
@@ -162,7 +164,7 @@ class FileUtilProxy {
       int64 offset,
       const char* buffer,
       int bytes_to_write,
-      ReadWriteCallback* callback);
+      WriteCallback* callback);
 
   // Touches a file. The callback can be NULL.
   static bool Touch(