diff options
| author | waffles@chromium.org <waffles@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2014-01-13 21:26:40 +0000 |
|---|---|---|
| committer | waffles@chromium.org <waffles@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2014-01-13 21:26:40 +0000 |
| commit | 10d58071cd760dd532f0ade9f44f37a7656a89f9 (patch) | |
| tree | d1f4eddb256458ad019ab121bf8e7e5e8c97d7cf /net/url_request | |
| parent | e6e30ac7da61cf09099d861344b3c22e5d5d158c (diff) | |
| download | chromium_src-10d58071cd760dd532f0ade9f44f37a7656a89f9.zip chromium_src-10d58071cd760dd532f0ade9f44f37a7656a89f9.tar.gz chromium_src-10d58071cd760dd532f0ade9f44f37a7656a89f9.tar.bz2 | |
Added check in URLFetcher's Finish() to prevent crash.
In some error cases, Finish() can be called after CloseAndDeleteFile(),
which will cause a crash if the latter function resets file_stream_.
BUG=330642
Review URL: https://codereview.chromium.org/115703003
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@244581 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'net/url_request')
| -rw-r--r-- | net/url_request/url_fetcher_response_writer.cc | 16 |
1 files changed, 10 insertions, 6 deletions
diff --git a/net/url_request/url_fetcher_response_writer.cc b/net/url_request/url_fetcher_response_writer.cc index 1a63d40..7d3c271 100644 --- a/net/url_request/url_fetcher_response_writer.cc +++ b/net/url_request/url_fetcher_response_writer.cc @@ -107,12 +107,16 @@ int URLFetcherFileWriter::Write(IOBuffer* buffer, } int URLFetcherFileWriter::Finish(const CompletionCallback& callback) { - int result = file_stream_->Close(base::Bind( - &URLFetcherFileWriter::CloseComplete, - weak_factory_.GetWeakPtr(), callback)); - if (result != ERR_IO_PENDING) - file_stream_.reset(); - return result; + // If the file_stream_ still exists at this point, close it. + if (file_stream_) { + int result = file_stream_->Close(base::Bind( + &URLFetcherFileWriter::CloseComplete, + weak_factory_.GetWeakPtr(), callback)); + if (result != ERR_IO_PENDING) + file_stream_.reset(); + return result; + } + return OK; } URLFetcherFileWriter* URLFetcherFileWriter::AsFileWriter() { |