Remove use-after-free bug.

sandbox/win/src/broker_services.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/win/src/broker_services.h"
 
 #include "base/logging.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/threading/platform_thread.h"
 #include "base/win/scoped_handle.h"
@@ skipping 279 matching lines @@
 
   // This downcast is safe as long as we control CreatePolicy()
   PolicyBase* policy_base = static_cast<PolicyBase*>(policy);
 
   // Construct the tokens and the job object that we are going to associate
   // with the soon to be created target process.
   HANDLE initial_token_temp;
   HANDLE lockdown_token_temp;
   DWORD win_result = policy_base->MakeTokens(&initial_token_temp,
                                              &lockdown_token_temp);
+  if (ERROR_SUCCESS != win_result)
+    return SBOX_ERROR_GENERIC;
+
   base::win::ScopedHandle initial_token(initial_token_temp);
   base::win::ScopedHandle lockdown_token(lockdown_token_temp);
 
-  if (ERROR_SUCCESS != win_result)
-    return SBOX_ERROR_GENERIC;
-
   HANDLE job_temp;
   win_result = policy_base->MakeJobObject(&job_temp);
   base::win::ScopedHandle job(job_temp);
   if (ERROR_SUCCESS != win_result)
     return SBOX_ERROR_GENERIC;
 
   if (ERROR_ALREADY_EXISTS == ::GetLastError())
     return SBOX_ERROR_GENERIC;
 
   // Construct the thread pool here in case it is expensive.
@@ skipping 80 matching lines @@
     peer_map_.erase(peer->id);
     return SBOX_ERROR_GENERIC;
   }
 
   // Release the pointer since it will be cleaned up by the callback.
   peer.release();
   return SBOX_ALL_OK;
 }
 
 }  // namespace sandbox