From 68f06af6f68c038fb9a1094951e0c7a0344a4db1 Mon Sep 17 00:00:00 2001 From: Markus Handell Date: Fri, 19 Nov 2021 12:20:24 +0100 Subject: [PATCH] WebRtcVideoChannelBaseTest.InvalidRecvBufferSize: fix UAF. The test could cause a UAF as the test exits while the lambda is still running. Only seems to happen on Linux for some reason. Bug: webrtc:12854 Change-Id: Ie0c0de09b675ef93dc195a6470752a772083029e Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/238425 Auto-Submit: Markus Handell Commit-Queue: Tommi Reviewed-by: Tommi Cr-Commit-Position: refs/heads/main@{#35389} --- media/engine/webrtc_video_engine_unittest.cc | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/media/engine/webrtc_video_engine_unittest.cc b/media/engine/webrtc_video_engine_unittest.cc index 01ba354c8a..7635bccb59 100644 --- a/media/engine/webrtc_video_engine_unittest.cc +++ b/media/engine/webrtc_video_engine_unittest.cc @@ -1850,10 +1850,11 @@ TEST_F(WebRtcVideoChannelBaseTest, InvalidRecvBufferSize) { // This particular hack, pauses the transport controller TQ while we // change the field trial. rtc::TaskQueue* tq = call_->GetTransportControllerSend()->GetWorkerQueue(); - rtc::Event waiting, resume; - tq->PostTask([&waiting, &resume]() { + rtc::Event waiting, resume, conclude; + tq->PostTask([&waiting, &resume, &conclude]() { waiting.Set(); resume.Wait(rtc::Event::kForever); + conclude.Set(); }); waiting.Wait(rtc::Event::kForever); @@ -1862,6 +1863,8 @@ TEST_F(WebRtcVideoChannelBaseTest, InvalidRecvBufferSize) { SetUp(); resume.Set(); + // Ensure we don't cause a UAF as the test scope exits. + conclude.Wait(rtc::Event::kForever); // OK, now the test can carry on.