Commit message: None
CVE: CVE-2012-2875
Vulnerability description: Multiple unspecified vulnerabilities in the PDF functionality in Google Chrome before 22.0.1229.79 allow remote attackers to have an unknown impact via a crafted document.

Project: Chrome

FileSystemOperation* FileSystemOperation::AsFileSystemOperation() {
  return this;
}

Project: Chrome

void FileSystemOperation::Cancel(const StatusCallback& cancel_callback) {
  if (file_writer_delegate_.get()) {
    DCHECK_EQ(kOperationWrite, pending_operation_);

    const bool delete_now = file_writer_delegate_->Cancel();

    if (!write_callback_.is_null()) {
      write_callback_.Run(base::PLATFORM_FILE_ERROR_ABORT, 0, false);
    }
    cancel_callback.Run(base::PLATFORM_FILE_OK);
    write_callback_.Reset();

    if (delete_now) {
      delete this;
      return;
    }
  } else {
    DCHECK_EQ(kOperationTruncate, pending_operation_);
    DCHECK(cancel_callback_.is_null());
    cancel_callback_ = cancel_callback;
  }
}

Project: Chrome

void FileSystemOperation::Copy(const GURL& src_path_url,
                               const GURL& dest_path_url,
                               const StatusCallback& callback) {
  DCHECK(SetPendingOperationType(kOperationCopy));

  base::PlatformFileError result = SetUpFileSystemPath(
      src_path_url, &src_path_, &src_util_, PATH_FOR_READ);
  if (result == base::PLATFORM_FILE_OK)
    result = SetUpFileSystemPath(
        dest_path_url, &dest_path_, &dest_util_, PATH_FOR_CREATE);
  if (result != base::PLATFORM_FILE_OK) {
    callback.Run(result);
    delete this;
    return;
  }

  GetUsageAndQuotaThenRunTask(
      dest_path_.origin(), dest_path_.type(),
      base::Bind(&FileSystemOperation::DoCopy,
                 base::Unretained(this), callback),
      base::Bind(callback, base::PLATFORM_FILE_ERROR_FAILED));
}

Project: Chrome

void FileSystemOperation::CreateFile(const GURL& path_url,
                                     bool exclusive,
                                     const StatusCallback& callback) {
  DCHECK(SetPendingOperationType(kOperationCreateFile));

  base::PlatformFileError result = SetUpFileSystemPath(
      path_url, &src_path_, &src_util_, PATH_FOR_CREATE);
  if (result != base::PLATFORM_FILE_OK) {
    callback.Run(result);
    delete this;
    return;
  }

  GetUsageAndQuotaThenRunTask(
      src_path_.origin(), src_path_.type(),
      base::Bind(&FileSystemOperation::DoCreateFile,
                 base::Unretained(this), callback, exclusive),
      base::Bind(callback, base::PLATFORM_FILE_ERROR_FAILED));
}

Project: Chrome

void FileSystemOperation::CreateSnapshotFile(
    const GURL& path_url,
    const SnapshotFileCallback& callback) {
  GetMetadata(path_url, base::Bind(&GetMetadataForSnapshot, callback));
}

Project: Chrome

void FileSystemOperation::DidDirectoryExists(
    const StatusCallback& callback,
    base::PlatformFileError rv,
    const base::PlatformFileInfo& file_info,
    const FilePath& unused) {
  if (rv == base::PLATFORM_FILE_OK && !file_info.is_directory)
    rv = base::PLATFORM_FILE_ERROR_NOT_A_DIRECTORY;
  callback.Run(rv);
}

Project: Chrome

void FileSystemOperation::DidEnsureFileExistsExclusive(
    const StatusCallback& callback,
    base::PlatformFileError rv, bool created) {
  if (rv == base::PLATFORM_FILE_OK && !created) {
    callback.Run(base::PLATFORM_FILE_ERROR_EXISTS);
  } else {
    DidFinishFileOperation(callback, rv);
  }
}

Project: Chrome

void FileSystemOperation::DidEnsureFileExistsNonExclusive(
    const StatusCallback& callback,
    base::PlatformFileError rv, bool /* created */) {
  DidFinishFileOperation(callback, rv);
}

Project: Chrome

void FileSystemOperation::DidFileExists(
    const StatusCallback& callback,
    base::PlatformFileError rv,
    const base::PlatformFileInfo& file_info,
    const FilePath& unused) {
  if (rv == base::PLATFORM_FILE_OK && file_info.is_directory)
    rv = base::PLATFORM_FILE_ERROR_NOT_A_FILE;
  callback.Run(rv);
}

Project: Chrome

void FileSystemOperation::DidFinishFileOperation(
    const StatusCallback& callback,
    base::PlatformFileError rv) {
  if (!cancel_callback_.is_null()) {
    DCHECK_EQ(kOperationTruncate, pending_operation_);

    callback.Run(base::PLATFORM_FILE_ERROR_ABORT);
    cancel_callback_.Run(base::PLATFORM_FILE_OK);
    cancel_callback_.Reset();
  } else {
    callback.Run(rv);
  }
}

Project: Chrome

void FileSystemOperation::DidGetMetadata(
    const GetMetadataCallback& callback,
    base::PlatformFileError rv,
    const base::PlatformFileInfo& file_info,
    const FilePath& platform_path) {
  callback.Run(rv, file_info, platform_path);
}

Project: Chrome

 void FileSystemOperation::DidGetUsageAndQuotaAndRunTask(
    const TaskParamsForDidGetQuota& params,
    quota::QuotaStatusCode status,
    int64 usage, int64 quota) {
  if (status != quota::kQuotaStatusOk) {
    LOG(WARNING) << "Got unexpected quota error : " << status;
    params.error_callback.Run();
    return;
  }

  operation_context_.set_allowed_bytes_growth(quota - usage);
  scoped_quota_notifier_.reset(new ScopedQuotaNotifier(
      file_system_context(), params.origin, params.type));

  params.task.Run();
}

Project: Chrome

void FileSystemOperation::DidOpenFile(
    const OpenFileCallback& callback,
    base::PlatformFileError rv,
    base::PassPlatformFile file,
    bool unused) {
  if (rv == base::PLATFORM_FILE_OK)
    CHECK_NE(base::kNullProcessHandle, peer_handle_);
  callback.Run(rv, file.ReleaseValue(), peer_handle_);
}

Project: Chrome

void FileSystemOperation::DidReadDirectory(
    const ReadDirectoryCallback& callback,
    base::PlatformFileError rv,
    const std::vector<base::FileUtilProxy::Entry>& entries,
    bool has_more) {
  callback.Run(rv, entries, has_more);
}

Project: Chrome

void FileSystemOperation::DidTouchFile(const StatusCallback& callback,
                                       base::PlatformFileError rv) {
  callback.Run(rv);
}

Project: Chrome

void FileSystemOperation::DidWrite(
    base::PlatformFileError rv,
    int64 bytes,
    bool complete) {
  if (write_callback_.is_null()) {
    delete this;
    return;
  }
  write_callback_.Run(rv, bytes, complete);
  if (complete || rv != base::PLATFORM_FILE_OK)
    delete this;
}

Project: Chrome

void FileSystemOperation::DoCopy(const StatusCallback& callback) {
  FileSystemFileUtilProxy::Copy(
      &operation_context_,
      src_util_, dest_util_,
      src_path_, dest_path_,
      base::Bind(&FileSystemOperation::DidFinishFileOperation,
                 base::Owned(this), callback));
}

Project: Chrome

void FileSystemOperation::DoCreateFile(
    const StatusCallback& callback,
    bool exclusive) {
  FileSystemFileUtilProxy::EnsureFileExists(
      &operation_context_,
      src_util_, src_path_,
      base::Bind(
          exclusive ? &FileSystemOperation::DidEnsureFileExistsExclusive
                    : &FileSystemOperation::DidEnsureFileExistsNonExclusive,
          base::Owned(this), callback));
}

Project: Chrome

void FileSystemOperation::DoMove(const StatusCallback& callback) {
  FileSystemFileUtilProxy::Move(
      &operation_context_,
      src_util_, dest_util_,
      src_path_, dest_path_,
      base::Bind(&FileSystemOperation::DidFinishFileOperation,
                 base::Owned(this), callback));
}

Project: Chrome

void FileSystemOperation::DoTruncate(const StatusCallback& callback,
                                     int64 length) {
  FileSystemFileUtilProxy::Truncate(
      &operation_context_, src_util_, src_path_, length,
      base::Bind(&FileSystemOperation::DidFinishFileOperation,
                 base::Owned(this), callback));
}

Project: Chrome

void FileSystemOperation::DoWrite(scoped_ptr<net::URLRequest> blob_request) {
  int file_flags = base::PLATFORM_FILE_OPEN |
                   base::PLATFORM_FILE_WRITE |
                   base::PLATFORM_FILE_ASYNC;

  FileSystemOperationContext* write_context = new FileSystemOperationContext(
      operation_context_);
  FileSystemFileUtilProxy::CreateOrOpen(
      write_context, src_util_, src_path_, file_flags,
      base::Bind(&FileSystemOperation::OnFileOpenedForWrite,
                 weak_factory_.GetWeakPtr(),
                 base::Passed(&blob_request),
                 base::Owned(write_context)));
}

Project: Chrome

FileSystemOperation::FileSystemOperation(
    FileSystemContext* file_system_context)
    : operation_context_(file_system_context),
      src_util_(NULL),
      dest_util_(NULL),
      peer_handle_(base::kNullProcessHandle),
      pending_operation_(kOperationNone),
      weak_factory_(ALLOW_THIS_IN_INITIALIZER_LIST(this)) {
}

Project: Chrome

void FileSystemOperation::GetMetadata(const GURL& path_url,
                                      const GetMetadataCallback& callback) {
  DCHECK(SetPendingOperationType(kOperationGetMetadata));

  base::PlatformFileError result = SetUpFileSystemPath(
      path_url, &src_path_, &src_util_, PATH_FOR_READ);
  if (result != base::PLATFORM_FILE_OK) {
    callback.Run(result, base::PlatformFileInfo(), FilePath());
    delete this;
    return;
  }

  FileSystemFileUtilProxy::GetFileInfo(
      &operation_context_, src_util_, src_path_,
      base::Bind(&FileSystemOperation::DidGetMetadata,
                 base::Owned(this), callback));
}

Project: Chrome

void GetMetadataForSnapshot(
    const FileSystemOperationInterface::SnapshotFileCallback& callback,
    base::PlatformFileError result,
    const base::PlatformFileInfo& file_info,
    const FilePath& platform_path) {
  callback.Run(result, file_info, platform_path, NULL);
}

Project: Chrome

void FileSystemOperation::OpenFile(const GURL& path_url,
                                   int file_flags,
                                   base::ProcessHandle peer_handle,
                                   const OpenFileCallback& callback) {
  DCHECK(SetPendingOperationType(kOperationOpenFile));
  scoped_ptr<FileSystemOperation> deleter(this);

  peer_handle_ = peer_handle;

  if (file_flags & (
      (base::PLATFORM_FILE_ENUMERATE | base::PLATFORM_FILE_TEMPORARY |
       base::PLATFORM_FILE_HIDDEN))) {
    callback.Run(base::PLATFORM_FILE_ERROR_FAILED,
                 base::PlatformFile(), base::ProcessHandle());
    return;
  }
  if (file_flags &
      (base::PLATFORM_FILE_CREATE | base::PLATFORM_FILE_OPEN_ALWAYS |
       base::PLATFORM_FILE_CREATE_ALWAYS | base::PLATFORM_FILE_OPEN_TRUNCATED |
       base::PLATFORM_FILE_WRITE | base::PLATFORM_FILE_EXCLUSIVE_WRITE |
       base::PLATFORM_FILE_DELETE_ON_CLOSE |
       base::PLATFORM_FILE_WRITE_ATTRIBUTES)) {
    base::PlatformFileError result = SetUpFileSystemPath(
        path_url, &src_path_, &src_util_, PATH_FOR_CREATE);
    if (result != base::PLATFORM_FILE_OK) {
      callback.Run(result, base::PlatformFile(), base::ProcessHandle());
      return;
    }
  } else {
    base::PlatformFileError result = SetUpFileSystemPath(
        path_url, &src_path_, &src_util_, PATH_FOR_READ);
    if (result != base::PLATFORM_FILE_OK) {
      callback.Run(result, base::PlatformFile(), base::ProcessHandle());
      return;
    }
  }
  GetUsageAndQuotaThenRunTask(
      src_path_.origin(), src_path_.type(),
      base::Bind(&FileSystemOperation::DoOpenFile,
                 base::Unretained(deleter.release()), callback, file_flags),
      base::Bind(callback, base::PLATFORM_FILE_ERROR_FAILED,
                 base::kInvalidPlatformFileValue,
                 base::kNullProcessHandle));
}

Project: Chrome

void FileSystemOperation::ReadDirectory(const GURL& path_url,
                                        const ReadDirectoryCallback& callback) {
  DCHECK(SetPendingOperationType(kOperationReadDirectory));

  base::PlatformFileError result = SetUpFileSystemPath(
      path_url, &src_path_, &src_util_, PATH_FOR_READ);
  if (result != base::PLATFORM_FILE_OK) {
    callback.Run(result, std::vector<base::FileUtilProxy::Entry>(), false);
    delete this;
    return;
  }

  FileSystemFileUtilProxy::ReadDirectory(
      &operation_context_, src_util_, src_path_,
      base::Bind(&FileSystemOperation::DidReadDirectory,
                 base::Owned(this), callback));
}

Project: Chrome

void FileSystemOperation::Remove(const GURL& path_url, bool recursive,
                                 const StatusCallback& callback) {
  DCHECK(SetPendingOperationType(kOperationRemove));

  base::PlatformFileError result = SetUpFileSystemPath(
      path_url, &src_path_, &src_util_, PATH_FOR_WRITE);
  if (result != base::PLATFORM_FILE_OK) {
    callback.Run(result);
    delete this;
    return;
  }

  scoped_quota_notifier_.reset(new ScopedQuotaNotifier(
      file_system_context(), src_path_.origin(), src_path_.type()));

  FileSystemFileUtilProxy::Delete(
      &operation_context_, src_util_, src_path_, recursive,
      base::Bind(&FileSystemOperation::DidFinishFileOperation,
                 base::Owned(this), callback));
}

Project: Chrome

FileSystemOperation::ScopedQuotaNotifier::ScopedQuotaNotifier(
    FileSystemContext* context, const GURL& origin_url, FileSystemType type)
    : origin_url_(origin_url), type_(type) {
  DCHECK(context);
  DCHECK(type_ != kFileSystemTypeUnknown);
  quota_util_ = context->GetQuotaUtil(type_);
  if (quota_util_) {
    DCHECK(quota_util_->proxy());
    quota_util_->proxy()->StartUpdateOrigin(origin_url_, type_);
  }
}

Project: Chrome

base::PlatformFileError FileSystemOperation::SetUpFileSystemPath(
    const GURL& path_url,
    FileSystemPath* file_system_path,
    FileSystemFileUtil** file_util,
    SetUpPathMode mode) {
  DCHECK(file_system_path);
  GURL origin_url;
  FileSystemType type;
  FilePath cracked_path;
  if (!CrackFileSystemURL(path_url, &origin_url, &type, &cracked_path))
    return base::PLATFORM_FILE_ERROR_INVALID_URL;

  if (!file_system_context()->GetMountPointProvider(type)->IsAccessAllowed(
          origin_url, type, cracked_path))
    return base::PLATFORM_FILE_ERROR_SECURITY;

  DCHECK(file_util);
  if (!*file_util)
    *file_util = file_system_context()->GetFileUtil(type);
  if (!*file_util)
    return base::PLATFORM_FILE_ERROR_SECURITY;

  file_system_path->set_origin(origin_url);
  file_system_path->set_type(type);
  file_system_path->set_internal_path(cracked_path);

  if (mode == PATH_FOR_READ) {
    FileSystemQuotaUtil* quota_util = file_system_context()->GetQuotaUtil(type);
    if (quota_util) {
      quota_util->NotifyOriginWasAccessedOnIOThread(
          file_system_context()->quota_manager_proxy(),
          file_system_path->origin(), file_system_path->type());
    }
    return base::PLATFORM_FILE_OK;
  }

  DCHECK(mode == PATH_FOR_WRITE || mode == PATH_FOR_CREATE);

  if (cracked_path.value().length() == 0 ||
      cracked_path.DirName().value() == cracked_path.value())
    return base::PLATFORM_FILE_ERROR_SECURITY;

  if (mode == PATH_FOR_CREATE) {
    FileSystemMountPointProvider* provider = file_system_context()->
        GetMountPointProvider(type);

    if (provider->IsRestrictedFileName(VirtualPath::BaseName(cracked_path)))
      return base::PLATFORM_FILE_ERROR_SECURITY;
  }

  return base::PLATFORM_FILE_OK;
}

Project: Chrome

FileSystemOperation::TaskParamsForDidGetQuota::TaskParamsForDidGetQuota()
    : type(kFileSystemTypeUnknown) {
}

Project: Chrome

void FileSystemOperation::TouchFile(const GURL& path_url,
                                    const base::Time& last_access_time,
                                    const base::Time& last_modified_time,
                                    const StatusCallback& callback) {
  DCHECK(SetPendingOperationType(kOperationTouchFile));

  base::PlatformFileError result = SetUpFileSystemPath(
      path_url, &src_path_, &src_util_, PATH_FOR_WRITE);
  if (result != base::PLATFORM_FILE_OK) {
    callback.Run(result);
    delete this;
    return;
  }

  FileSystemFileUtilProxy::Touch(
      &operation_context_, src_util_, src_path_,
      last_access_time, last_modified_time,
      base::Bind(&FileSystemOperation::DidTouchFile,
                 base::Owned(this), callback));
}

Project: Chrome

void FileSystemOperation::Truncate(const GURL& path_url, int64 length,
                                   const StatusCallback& callback) {
  DCHECK(SetPendingOperationType(kOperationTruncate));

  base::PlatformFileError result = SetUpFileSystemPath(
      path_url, &src_path_, &src_util_, PATH_FOR_WRITE);
  if (result != base::PLATFORM_FILE_OK) {
    callback.Run(result);
    delete this;
    return;
  }
  GetUsageAndQuotaThenRunTask(
      src_path_.origin(), src_path_.type(),
      base::Bind(&FileSystemOperation::DoTruncate,
                 base::Unretained(this), callback, length),
      base::Bind(callback, base::PLATFORM_FILE_ERROR_FAILED));
}

Project: Chrome

void FileSystemOperation::Write(
    const net::URLRequestContext* url_request_context,
    const GURL& path_url,
    const GURL& blob_url,
    int64 offset,
    const WriteCallback& callback) {
  DCHECK(SetPendingOperationType(kOperationWrite));

  base::PlatformFileError result = SetUpFileSystemPath(
      path_url, &src_path_, &src_util_, PATH_FOR_WRITE);
  if (result != base::PLATFORM_FILE_OK) {
    callback.Run(result, 0, false);
    delete this;
    return;
  }
  DCHECK(blob_url.is_valid());
  file_writer_delegate_.reset(new FileWriterDelegate(
          this, src_path_, offset));
  set_write_callback(callback);
  scoped_ptr<net::URLRequest> blob_request(
      new net::URLRequest(blob_url, file_writer_delegate_.get()));
  blob_request->set_context(url_request_context);

  GetUsageAndQuotaThenRunTask(
      src_path_.origin(), src_path_.type(),
      base::Bind(&FileSystemOperation::DoWrite, weak_factory_.GetWeakPtr(),
                 base::Passed(&blob_request)),
      base::Bind(callback, base::PLATFORM_FILE_ERROR_FAILED, 0, true));
}

Project: Chrome

FileSystemOperation::~FileSystemOperation() {
  if (file_writer_delegate_.get()) {
    FileSystemOperationContext* c =
        new FileSystemOperationContext(operation_context_);
    base::FileUtilProxy::RelayClose(
        file_system_context()->file_task_runner(),
        base::Bind(&FileSystemFileUtil::Close,
                   base::Unretained(src_util_),
                   base::Owned(c)),
        file_writer_delegate_->file(),
        base::FileUtilProxy::StatusCallback());
  }
}

Project: Chrome

FileSystemOperation::ScopedQuotaNotifier::~ScopedQuotaNotifier() {
  if (quota_util_) {
    DCHECK(quota_util_->proxy());
    quota_util_->proxy()->EndUpdateOrigin(origin_url_, type_);
  }
}

Project: Chrome

FileSystemOperation::TaskParamsForDidGetQuota::~TaskParamsForDidGetQuota() {}