admin/webrtc_m130
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

BandwidthEndToEndTest.RembWithSendSideBwe: fix UAF.

Browse Source 
The test has a ModuleRtpRtcpImpl2 which is destroyed long
after test transports are removed, leading to a UAF.
Fix by overriding OnStreamsStopped which is called before
transports are removed.

TESTED=Asan now passes 1000/1000, failed 4/1000 before.

Fixed: chromium:1235251, b:192567426
Change-Id: Ie9135685e81712e38c4b00355debfc67c1f603bd
Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/237345
Reviewed-by: Stefan Holmer <stefan@webrtc.org>
Reviewed-by: Sergey Silkin <ssilkin@webrtc.org>
Commit-Queue: Stefan Holmer <stefan@webrtc.org>
Cr-Commit-Position: refs/heads/main@{#35318}
This commit is contained in:
Markus Handell 2021-11-05 16:48:38 +01:00 committed by WebRTC LUCI CQ
parent a52fc6f940
commit 3da2577038
1 changed files with 1 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
video/end_to_end_tests/bandwidth_tests.cc
View File

@ -204,12 +204,7 @@ TEST_F(BandwidthEndToEndTest, RembWithSendSideBwe) {
retransmission_rate_limiter_(clock_, 1000),
task_queue_(task_queue) {}
~BweObserver() override {
// Block until all already posted tasks run to avoid races when such task
// accesses `this`. Also make sure we free `rtp_rtcp_` on the correct
// thread/task queue.
SendTask(RTC_FROM_HERE, task_queue_, [this]() { rtp_rtcp_ = nullptr; });
}
void OnStreamsStopped() override { rtp_rtcp_ = nullptr; }
std::unique_ptr<test::PacketTransport> CreateReceiveTransport(
TaskQueueBase* task_queue) override {