From 939daf833fff3a9901afb6fd65d02e0f057a494a Mon Sep 17 00:00:00 2001 From: Maks Orlovich Date: Tue, 27 Aug 2019 02:08:14 +0000 Subject: [Backport] Security bug 955191 MemCache: make refcount checks CHECK, not DCHECK Matching RefCountedBase. Bug: 955191 Change-Id: I77e20d7a6e72656c4b00c9fa99fc4d19ad0bafa3 Reviewed-by: Allan Sandfeld Jensen --- chromium/net/disk_cache/memory/mem_entry_impl.cc | 4 ++-- chromium/net/disk_cache/memory/mem_entry_impl.h | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/chromium/net/disk_cache/memory/mem_entry_impl.cc b/chromium/net/disk_cache/memory/mem_entry_impl.cc index bb9affc918b..93680d2aec2 100644 --- a/chromium/net/disk_cache/memory/mem_entry_impl.cc +++ b/chromium/net/disk_cache/memory/mem_entry_impl.cc @@ -103,8 +103,8 @@ MemEntryImpl::MemEntryImpl(base::WeakPtr backend, void MemEntryImpl::Open() { // Only a parent entry can be opened. DCHECK_EQ(PARENT_ENTRY, type()); + CHECK_NE(ref_count_, std::numeric_limits::max()); ++ref_count_; - DCHECK_GE(ref_count_, 1); DCHECK(!doomed_); } @@ -144,6 +144,7 @@ void MemEntryImpl::Doom() { void MemEntryImpl::Close() { DCHECK_EQ(PARENT_ENTRY, type()); + CHECK_GT(ref_count_, 0u); --ref_count_; if (ref_count_ == 0 && !doomed_) { // At this point the user is clearly done writing, so make sure there isn't @@ -156,7 +157,6 @@ void MemEntryImpl::Close() { } } } - DCHECK_GE(ref_count_, 0); if (!ref_count_ && doomed_) delete this; } diff --git a/chromium/net/disk_cache/memory/mem_entry_impl.h b/chromium/net/disk_cache/memory/mem_entry_impl.h index a372dd5e9fa..be4934c02e3 100644 --- a/chromium/net/disk_cache/memory/mem_entry_impl.h +++ b/chromium/net/disk_cache/memory/mem_entry_impl.h @@ -179,7 +179,7 @@ class NET_EXPORT_PRIVATE MemEntryImpl final std::string key_; std::vector data_[kNumStreams]; // User data. - int ref_count_; + uint32_t ref_count_; int64_t child_id_; // The ID of a child entry. int child_first_pos_; // The position of the first byte in a child -- cgit v1.2.1