Sandbox: Verify that members of TargetProcess are valid before freeing them.

sandbox/win/src/target_process.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/win/src/target_process.h"
 
 #include "base/basictypes.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/win/pe_image.h"
 #include "base/win/windows_version.h"
@@ skipping 88 matching lines @@
 TargetProcess::~TargetProcess() {
   DWORD exit_code = 0;
   // Give a chance to the process to die. In most cases the JOB_KILL_ON_CLOSE
   // will take effect only when the context changes. As far as the testing went,
   // this wait was enough to switch context and kill the processes in the job.
   // If this process is already dead, the function will return without waiting.
   // TODO(nsylvain):  If the process is still alive at the end, we should kill
   // it. http://b/893891
   // For now, this wait is there only to do a best effort to prevent some leaks
   // from showing up in purify.
-  ::WaitForSingleObject(sandbox_process_info_.process_handle(), 50);
-  if (!::GetExitCodeProcess(sandbox_process_info_.process_handle(),
-                            &exit_code) || (STILL_ACTIVE == exit_code)) {
-    // It is an error to destroy this object while the target process is still
-    // alive because we need to destroy the IPC subsystem and cannot risk to
-    // have an IPC reach us after this point.
-    shared_section_.Take();
-    SharedMemIPCServer* server = ipc_server_.release();
-    sandbox_process_info_.TakeProcessHandle();
-    return;
+  if (sandbox_process_info_.IsValid()) {
+    ::WaitForSingleObject(sandbox_process_info_.process_handle(), 50);
+    if (!::GetExitCodeProcess(sandbox_process_info_.process_handle(),
+                              &exit_code) || (STILL_ACTIVE == exit_code)) {
+      // It is an error to destroy this object while the target process is still
+      // alive because we need to destroy the IPC subsystem and cannot risk to
+      // have an IPC reach us after this point.
+      if (shared_section_.IsValid())
+        shared_section_.Take();
+      SharedMemIPCServer* server = ipc_server_.release();
+      sandbox_process_info_.TakeProcessHandle();
+      return;
+    }
   }
 
   // ipc_server_ references our process handle, so make sure the former is shut
   // down before the latter is closed (by ScopedProcessInformation).
   ipc_server_.reset();
 }
 
 // Creates the target (child) process suspended and assigns it to the job
 // object.
 DWORD TargetProcess::Create(const wchar_t* exe_path,
@@ skipping 217 matching lines @@
 
 
 TargetProcess* MakeTestTargetProcess(HANDLE process, HMODULE base_address) {
   TargetProcess* target = new TargetProcess(NULL, NULL, NULL, NULL);
   target->sandbox_process_info_.Receive()->hProcess = process;
   target->base_address_ = base_address;
   return target;
 }
 
 }  // namespace sandbox