diff options
| author | pliard@chromium.org <pliard@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2014-01-10 11:38:44 +0000 |
|---|---|---|
| committer | pliard@chromium.org <pliard@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2014-01-10 11:38:44 +0000 |
| commit | 6724686e6151cb4a1ea1d651a5555ec7d46b3efb (patch) | |
| tree | 48871ca9054f8b203a28c803ce477e617971e86a /tools/android | |
| parent | 491af3c6d9727468104785d3df5b0583025f7420 (diff) | |
| download | chromium_src-6724686e6151cb4a1ea1d651a5555ec7d46b3efb.zip chromium_src-6724686e6151cb4a1ea1d651a5555ec7d46b3efb.tar.gz chromium_src-6724686e6151cb4a1ea1d651a5555ec7d46b3efb.tar.bz2 | |
Fix double free in DeviceController (forwarder2).
This happened in an error code path rarely exercised which is why it didn't
show up very often.
BUG=332403
R=bulach@chromium.org
Review URL: https://codereview.chromium.org/132053003
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@244149 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'tools/android')
| -rw-r--r-- | tools/android/forwarder2/device_controller.cc | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/tools/android/forwarder2/device_controller.cc b/tools/android/forwarder2/device_controller.cc index 37b754b..a4cb9c7 100644 --- a/tools/android/forwarder2/device_controller.cc +++ b/tools/android/forwarder2/device_controller.cc @@ -141,17 +141,18 @@ void DeviceController::AcceptHostCommandInternal() { void DeviceController::DeleteListenerOnError( const base::WeakPtr<DeviceController>& device_controller_ptr, scoped_ptr<DeviceListener> device_listener) { + DeviceListener* const listener = device_listener.release(); DeviceController* const controller = device_controller_ptr.get(); if (!controller) { - // |device_listener| was already deleted by the controller that did have - // its ownership. - ignore_result(device_listener.release()); + // |listener| was already deleted by the controller that did have its + // ownership. return; } DCHECK(controller->construction_task_runner_->RunsTasksOnCurrentThread()); bool listener_did_exist = DeleteRefCountedValueInMap( - device_listener->listener_port(), &controller->listeners_); + listener->listener_port(), &controller->listeners_); DCHECK(listener_did_exist); + // Note that |listener| was deleted by DeleteRefCountedValueInMap(). } } // namespace forwarder |