diff options
| author | mattm@chromium.org <mattm@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2013-02-05 02:07:30 +0000 |
|---|---|---|
| committer | mattm@chromium.org <mattm@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2013-02-05 02:07:30 +0000 |
| commit | 065836fc0f72e86049938f21ee55557b20a236f9 (patch) | |
| tree | 667201ea7b8c0c939df9e30e6dc3adfe0dc3da32 /net | |
| parent | a4197adc1699df5628e726c73c5a3b9dd67c9db2 (diff) | |
| download | chromium_src-065836fc0f72e86049938f21ee55557b20a236f9.zip chromium_src-065836fc0f72e86049938f21ee55557b20a236f9.tar.gz chromium_src-065836fc0f72e86049938f21ee55557b20a236f9.tar.bz2 | |
Fix ServerBoundCertService::RequestHandle::OnRequestComplete possible use after free.
BUG=173465
Review URL: https://chromiumcodereview.appspot.com/12092104
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@180603 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'net')
| -rw-r--r-- | net/base/server_bound_cert_service.cc | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/net/base/server_bound_cert_service.cc b/net/base/server_bound_cert_service.cc index e00d7bc..e6c5166 100644 --- a/net/base/server_bound_cert_service.cc +++ b/net/base/server_bound_cert_service.cc @@ -9,6 +9,7 @@ #include "base/bind.h" #include "base/bind_helpers.h" +#include "base/callback_helpers.h" #include "base/compiler_specific.h" #include "base/location.h" #include "base/logging.h" @@ -398,8 +399,9 @@ void ServerBoundCertService::RequestHandle::RequestStarted( void ServerBoundCertService::RequestHandle::OnRequestComplete(int result) { request_ = NULL; - callback_.Run(result); - callback_.Reset(); + // Running the callback might delete |this|, so we can't touch any of our + // members afterwards. Reset callback_ first. + base::ResetAndReturn(&callback_).Run(result); } ServerBoundCertService::ServerBoundCertService( |