New issue
Advanced search Search tips

Issue 835963 link

Starred by 2 users
Status: Fixed
Owner:
mmenke@chromium.org
Closed: Apr 2018
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 3
Type: Bug
Proj-Servicification



Sign in to add a comment

SimpleURLLoader: Can't access the download path after deleting the SimpleURLLoader

Project Member Reported by mmenke@chromium.org, Apr 23 2018 
When downloading to a file, SimpleURLLoader provide the path of the file on completion. The path is owned by the SimpleURLLoader (indirectly), so the path cannot be accessed after deleting the SimpleURLLoader.  The download-to-string path was written to avoid this issue, so I think we should support this use case for download-to-file as well.
Project Member

Comment 1 by bugdroid1@chromium.org, Apr 25 2018 

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/1e87fd07fcd40a2b1c3ad4ac4e0e55e4cf69966e

commit 1e87fd07fcd40a2b1c3ad4ac4e0e55e4cf69966e
Author: Matt Menke <mmenke@chromium.org>
Date: Wed Apr 25 21:13:27 2018

SimpleURLLoader: Make downloaded file path accessible after destruction.

When downloading to a file, if code deleted the SimpleURLLoader on
completion, and then tried to access the FilePath object passed to them
by the SimpleURLLoader, they're run into a use-after-free. This CL fixes
that.

Bug:  835963 
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_mojo
Change-Id: I8b840544be743aa979145bf46c8d35de4b25c12c
Reviewed-on: https://chromium-review.googlesource.com/1024694
Commit-Queue: Matt Menke <mmenke@chromium.org>
Reviewed-by: Steven Bennetts <stevenjb@chromium.org>
Reviewed-by: Maks Orlovich <morlovich@chromium.org>
Cr-Commit-Position: refs/heads/master@{#553745}
[modify] https://crrev.com/1e87fd07fcd40a2b1c3ad4ac4e0e55e4cf69966e/chrome/browser/chromeos/customization/customization_wallpaper_downloader.cc
[modify] https://crrev.com/1e87fd07fcd40a2b1c3ad4ac4e0e55e4cf69966e/chrome/browser/chromeos/customization/customization_wallpaper_downloader.h
[modify] https://crrev.com/1e87fd07fcd40a2b1c3ad4ac4e0e55e4cf69966e/chrome/browser/net/file_downloader.cc
[modify] https://crrev.com/1e87fd07fcd40a2b1c3ad4ac4e0e55e4cf69966e/chrome/browser/net/file_downloader.h
[modify] https://crrev.com/1e87fd07fcd40a2b1c3ad4ac4e0e55e4cf69966e/services/network/public/cpp/simple_url_loader.cc
[modify] https://crrev.com/1e87fd07fcd40a2b1c3ad4ac4e0e55e4cf69966e/services/network/public/cpp/simple_url_loader.h
[modify] https://crrev.com/1e87fd07fcd40a2b1c3ad4ac4e0e55e4cf69966e/services/network/public/cpp/simple_url_loader_stream_consumer.h
[modify] https://crrev.com/1e87fd07fcd40a2b1c3ad4ac4e0e55e4cf69966e/services/network/public/cpp/simple_url_loader_unittest.cc

Comment 2 by mmenke@chromium.org, Apr 25 2018

Status: Fixed (was: Assigned)
►

Sign in to add a comment