From 1cb799c31c882e60d1d3d24863b61811a039d40c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Erik=20Spr=C3=A5ng?= Date: Tue, 30 Aug 2022 12:02:14 +0200 Subject: [PATCH] Prevent potential UAF during VideoStreamEncoder teardown. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bug: chromium:1357413 Change-Id: I9ec4d4fbafe1c25530346faf09f5b437fad718cc Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/273482 Reviewed-by: Markus Handell Commit-Queue: Henrik Boström Auto-Submit: Erik Språng Reviewed-by: Henrik Boström Commit-Queue: Markus Handell Cr-Commit-Position: refs/heads/main@{#37948} --- video/video_stream_encoder.h | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/video/video_stream_encoder.h b/video/video_stream_encoder.h index 468998fb50..60fd263ea4 100644 --- a/video/video_stream_encoder.h +++ b/video/video_stream_encoder.h @@ -450,12 +450,15 @@ class VideoStreamEncoder : public VideoStreamEncoderInterface, const absl::optional vp9_low_tier_core_threshold_; + // Used to cancel any potentially pending tasks to the worker thread. + // Refrenced by tasks running on `encoder_queue_` so need to be destroyed + // after stopping that queue. Must be created and destroyed on + // `worker_queue_`. + ScopedTaskSafety task_safety_; + // Public methods are proxied to the task queues. The queues must be destroyed // first to make sure no tasks run that use other members. rtc::TaskQueue encoder_queue_; - - // Used to cancel any potentially pending tasks to the worker thread. - ScopedTaskSafety task_safety_; }; } // namespace webrtc