Fix a crash in net::SSLClientSocketWin::OnIOComplete(int) when

an HttpNetworkTransaction is destroyed while its SSLClientSocket
is verifying a certificate.

Document that ClientSocket::Disconnect aborts any pending IO and
prevents completion callback from running, like a cancel method.

Change the verifier_ member of SSLClientSocket to a scoped_ptr so
that we can destroy the CertVerifier object in the Disconnect method.
(CertVerifier doesn't have a cancel method, so we cancel pending
certificate verification by destroying the CertVerifier object.)

R=willchan
BUG=http://crbug.com/13981
TEST=none.  I can only reproduce this crash by modifying the
source code to create that condition.
Review URL: http://codereview.chromium.org/147159

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@19307 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 3 insertions, 2 deletions

diff --git a/net/socket/ssl_client_socket_win.h b/net/socket/ssl_client_socket_win.h
index 6e03309..461047c 100644
--- a/net/socket/ssl_client_socket_win.h
+++ b/net/socket/ssl_client_socket_win.h
@@ -14,7 +14,6 @@
 #include <string>
 
 #include "base/scoped_ptr.h"
-#include "net/base/cert_verifier.h"
 #include "net/base/cert_verify_result.h"
 #include "net/base/completion_callback.h"
 #include "net/base/ssl_config_service.h"
@@ -22,6 +21,8 @@
 
 namespace net {
 
+class CertVerifier;
+
 // An SSL client socket implemented with the Windows Schannel.
 class SSLClientSocketWin : public SSLClientSocket {
  public:
@@ -104,7 +105,7 @@ class SSLClientSocketWin : public SSLClientSocket {
 
   SecPkgContext_StreamSizes stream_sizes_;
   scoped_refptr<X509Certificate> server_cert_;
-  CertVerifier verifier_;
+  scoped_ptr<CertVerifier> verifier_;
   CertVerifyResult server_cert_verify_result_;
 
   CredHandle* creds_;