Commit message: None
CVE: CVE-2015-1272
Vulnerability description: Use-after-free vulnerability in the GPU process implementation in Google Chrome before 44.0.2403.89 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging the continued availability of a GPUChannelHost data structure during Blink shutdown, related to content/browser/gpu/browser_gpu_channel_host_factory.cc and content/renderer/render_thread_impl.cc.

Project: Chrome

void WriteFromUrlOperation::DestroyUrlFetcher() { url_fetcher_.reset(); }

Project: Chrome

void WriteFromUrlOperation::GetDownloadTarget(
    const base::Closure& continuation) {
  DCHECK_CURRENTLY_ON(BrowserThread::FILE);
  if (IsCancelled()) {
    return;
  }

  if (url_.ExtractFileName().empty()) {
    if (!base::CreateTemporaryFileInDir(temp_dir_.GetPath(), &image_path_)) {
      Error(error::kTempFileError);
      return;
    }
  } else {
    base::FilePath file_name =
        base::FilePath::FromUTF8Unsafe(url_.ExtractFileName());
    image_path_ = temp_dir_.GetPath().Append(file_name);
  }

  BrowserThread::PostTask(BrowserThread::FILE, FROM_HERE, continuation);
}

Project: Chrome

void WriteFromUrlOperation::OnURLFetchComplete(const net::URLFetcher* source) {
  DCHECK_CURRENTLY_ON(BrowserThread::FILE);

  if (source->GetStatus().is_success() && source->GetResponseCode() == 200) {
    SetProgress(kProgressComplete);

    download_continuation_.Run();

    download_continuation_ = base::Closure();
  } else {
    Error(error::kDownloadInterrupted);
  }
}

Project: Chrome

void WriteFromUrlOperation::OnURLFetchDownloadProgress(
    const net::URLFetcher* source,
    int64_t current,
    int64_t total,
    int64_t current_network_bytes) {
  DCHECK_CURRENTLY_ON(BrowserThread::FILE);

  if (IsCancelled()) {
    url_fetcher_.reset(NULL);
  }

  int progress = (kProgressComplete * current) / total;

  SetProgress(progress);
}

Project: Chrome

void WriteFromUrlOperation::OnURLFetchUploadProgress(
    const net::URLFetcher* source,
    int64_t current,
    int64_t total) {
}

Project: Chrome

void WriteFromUrlOperation::StartImpl() {
  DCHECK_CURRENTLY_ON(BrowserThread::FILE);

  GetDownloadTarget(base::Bind(
      &WriteFromUrlOperation::Download,
      this,
      base::Bind(
          &WriteFromUrlOperation::VerifyDownload,
          this,
          base::Bind(
              &WriteFromUrlOperation::Unzip,
              this,
              base::Bind(&WriteFromUrlOperation::Write,
                         this,
                         base::Bind(&WriteFromUrlOperation::VerifyWrite,
                                    this,
                                    base::Bind(&WriteFromUrlOperation::Finish,
                                               this)))))));
}

Project: Chrome

void WriteFromUrlOperation::VerifyDownload(const base::Closure& continuation) {
  DCHECK_CURRENTLY_ON(BrowserThread::FILE);

  if (IsCancelled()) {
    return;
  }

  if (hash_.empty()) {
    BrowserThread::PostTask(BrowserThread::FILE, FROM_HERE, continuation);
    return;
  }

  SetStage(image_writer_api::STAGE_VERIFYDOWNLOAD);

  GetMD5SumOfFile(
      image_path_,
      0,
      0,
      kProgressComplete,
      base::Bind(
          &WriteFromUrlOperation::VerifyDownloadCompare, this, continuation));
}

Project: Chrome

void WriteFromUrlOperation::VerifyDownloadCompare(
    const base::Closure& continuation,
    const std::string& download_hash) {
  DCHECK_CURRENTLY_ON(BrowserThread::FILE);
  if (download_hash != hash_) {
    Error(error::kDownloadHashError);
    return;
  }

  BrowserThread::PostTask(
      BrowserThread::FILE,
      FROM_HERE,
      base::Bind(
          &WriteFromUrlOperation::VerifyDownloadComplete, this, continuation));
}

Project: Chrome

void WriteFromUrlOperation::VerifyDownloadComplete(
    const base::Closure& continuation) {
  DCHECK_CURRENTLY_ON(BrowserThread::FILE);
  if (IsCancelled()) {
    return;
  }

  SetProgress(kProgressComplete);
  BrowserThread::PostTask(BrowserThread::FILE, FROM_HERE, continuation);
}

Project: Chrome

WriteFromUrlOperation::WriteFromUrlOperation(
    base::WeakPtr<OperationManager> manager,
    const ExtensionId& extension_id,
    net::URLRequestContextGetter* request_context,
    GURL url,
    const std::string& hash,
    const std::string& device_path,
    const base::FilePath& download_folder)
    : Operation(manager, extension_id, device_path, download_folder),
      request_context_(request_context),
      url_(url),
      hash_(hash),
      download_continuation_() {}

Project: Chrome

WriteFromUrlOperation::~WriteFromUrlOperation() {
}