Fix a use after free crasher in the ReadAsync task initiated on Windows by the FileStream::Context:…

net/base/file_stream_context_win.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/file_stream_context.h"
 
 #include <windows.h>
 
 #include "base/files/file_path.h"
 #include "base/logging.h"
@@ skipping 23 matching lines @@
   SetOffset(overlapped, offset);
 }
 
 }  // namespace
 
 FileStream::Context::Context(const scoped_refptr<base::TaskRunner>& task_runner)
     : io_context_(),
       async_in_progress_(false),
       orphaned_(false),
       task_runner_(task_runner),
-      weak_ptr_factory_(this) {
+      async_read_initiated_(false),
+      async_read_completed_(false),
+      io_complete_for_read_received_(false),
+      result_(0) {
   io_context_.handler = this;
   memset(&io_context_.overlapped, 0, sizeof(io_context_.overlapped));
 }
 
 FileStream::Context::Context(base::File file,
                              const scoped_refptr<base::TaskRunner>& task_runner)
     : io_context_(),
       file_(file.Pass()),
       async_in_progress_(false),
       orphaned_(false),
       task_runner_(task_runner),
-      weak_ptr_factory_(this) {
+      async_read_initiated_(false),
+      async_read_completed_(false),
+      io_complete_for_read_received_(false),
+      result_(0) {
   io_context_.handler = this;
   memset(&io_context_.overlapped, 0, sizeof(io_context_.overlapped));
   if (file_.IsValid()) {
     // TODO(hashimoto): Check that file_ is async.
     OnFileOpened();
   }
 }
 
 FileStream::Context::~Context() {
 }
 
 int FileStream::Context::Read(IOBuffer* buf,
                               int buf_len,
                               const CompletionCallback& callback) {
   // TODO(vadimt): Remove ScopedTracker below once crbug.com/423948 is fixed.
   tracked_objects::ScopedTracker tracking_profile(
       FROM_HERE_WITH_EXPLICIT_FUNCTION("423948 FileStream::Context::Read"));
 
-  DCHECK(!async_in_progress_);
+  CHECK(!async_in_progress_);
+  DCHECK(!async_read_initiated_);
+  DCHECK(!async_read_completed_);
+  DCHECK(!io_complete_for_read_received_);
 
   IOCompletionIsPending(callback, buf);
 
-  base::WorkerPool::PostTask(
+  async_read_initiated_ = true;
+
+  task_runner_->PostTask(
       FROM_HERE,
-      base::Bind(&FileStream::Context::ReadAsync,
-                 weak_ptr_factory_.GetWeakPtr(), file_.GetPlatformFile(),
-                 make_scoped_refptr(buf), buf_len, &io_context_.overlapped,
-                 base::MessageLoop::current()->message_loop_proxy()),
-      false);
-
+      base::Bind(&FileStream::Context::ReadAsync, base::Unretained(this),
+                 file_.GetPlatformFile(), make_scoped_refptr(buf), buf_len,
+                 &io_context_.overlapped,
+                 base::MessageLoop::current()->message_loop_proxy()));
   return ERR_IO_PENDING;
 }
 
 int FileStream::Context::Write(IOBuffer* buf,
                                int buf_len,
                                const CompletionCallback& callback) {
+  CHECK(!async_in_progress_);
+
   DWORD bytes_written = 0;
   if (!WriteFile(file_.GetPlatformFile(), buf->data(), buf_len,
                  &bytes_written, &io_context_.overlapped)) {
     IOResult error = IOResult::FromOSError(GetLastError());
     if (error.os_error == ERROR_IO_PENDING)
       IOCompletionIsPending(callback, buf);
     else
       LOG(WARNING) << "WriteFile failed: " << error.os_error;
     return static_cast<int>(error.result);
   }
@@ skipping 30 matching lines @@
 }
 
 void FileStream::Context::OnIOCompleted(
     base::MessageLoopForIO::IOContext* context,
     DWORD bytes_read,
     DWORD error) {
   DCHECK_EQ(&io_context_, context);
   DCHECK(!callback_.is_null());
   DCHECK(async_in_progress_);
 
-  async_in_progress_ = false;
+  if (!async_read_initiated_)
+    async_in_progress_ = false;
+
   if (orphaned_) {
+    async_in_progress_ = false;
     callback_.Reset();
     in_flight_buf_ = NULL;
     CloseAndDelete();
     return;
   }
 
-  int result;
   if (error == ERROR_HANDLE_EOF) {
-    result = 0;
+    result_ = 0;
   } else if (error) {
     IOResult error_result = IOResult::FromOSError(error);
-    result = static_cast<int>(error_result.result);
+    result_ = static_cast<int>(error_result.result);
   } else {
-    result = bytes_read;
+    result_ = bytes_read;
     IncrementOffset(&io_context_.overlapped, bytes_read);
   }
 
+  if (async_read_initiated_)
+    io_complete_for_read_received_ = true;
+
+  InvokeUserCallback();
+}
+
+void FileStream::Context::InvokeUserCallback() {
+  // For an asynchonous Read operation don't invoke the user callback until
+  // we receive the IO completion notification and the asynchronous Read
+  // completion notification.
+  if (async_read_initiated_) {
+    if (!io_complete_for_read_received_ || !async_read_completed_)
+      return;
+    async_read_initiated_ = false;
+    io_complete_for_read_received_ = false;
+    async_read_completed_ = false;
+    async_in_progress_ = false;
+  }
   CompletionCallback temp_callback = callback_;
   callback_.Reset();
   scoped_refptr<IOBuffer> temp_buf = in_flight_buf_;
   in_flight_buf_ = NULL;
-  temp_callback.Run(result);
+  temp_callback.Run(result_);
 }
 
 // static
 void FileStream::Context::ReadAsync(
-    const base::WeakPtr<FileStream::Context>& context,
+    FileStream::Context* context,
     HANDLE file,
     scoped_refptr<net::IOBuffer> buf,
     int buf_len,
     OVERLAPPED* overlapped,
     scoped_refptr<base::MessageLoopProxy> origin_thread_loop) {
   DWORD bytes_read = 0;
-  if (!ReadFile(file, buf->data(), buf_len, &bytes_read, overlapped)) {
-    origin_thread_loop->PostTask(
-        FROM_HERE, base::Bind(&FileStream::Context::ReadAsyncResult, context,
-                              ::GetLastError()));
-  }
+  ReadFile(file, buf->data(), buf_len, &bytes_read, overlapped);
+  origin_thread_loop->PostTask(
+      FROM_HERE,
+      base::Bind(&FileStream::Context::ReadAsyncResult,
+                 base::Unretained(context), bytes_read, ::GetLastError()));

[rvargas (doing something else), 2015/02/06 01:46:33]

bytes read is only valid if ReadFile returns true so the return value cannot be
ignored.

[ananta, 2015/02/06 02:20:01]

Done.

 }
 
-void FileStream::Context::ReadAsyncResult(DWORD os_error) {
+void FileStream::Context::ReadAsyncResult(DWORD bytes_read, DWORD os_error) {
+  if (bytes_read)
+    result_ = bytes_read;
+
   IOResult error = IOResult::FromOSError(os_error);
   if (error.os_error == ERROR_HANDLE_EOF) {
     // Report EOF by returning 0 bytes read.
     OnIOCompleted(&io_context_, 0, error.os_error);
   } else if (error.os_error != ERROR_IO_PENDING) {
     // We don't need to inform the caller about ERROR_PENDING_IO as that was
     // already done when the ReadFile call was queued to the worker pool.
-    if (error.os_error)
+    if (error.os_error) {
       LOG(WARNING) << "ReadFile failed: " << error.os_error;
-    OnIOCompleted(&io_context_, 0, error.os_error);
+      OnIOCompleted(&io_context_, 0, error.os_error);
+    }
   }
+  async_read_completed_ = true;
+  InvokeUserCallback();
 }
 
 }  // namespace net