admin/webrtc_m130
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

FrameCadenceAdapter: stop delayed refresh frame calls on dtor.

Browse Source 
The FrameCadenceAdapter starts a delayed task to request a
new refresh frame on receiving frame drop. However, the
resulting RepeatingTaskHandle was not Stop()ed on destruction,
leading to UAF.

Fixed: chromium:1478944
Change-Id: Iba441420953e989cfc7fcfd2f358b5b30f375786
Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/320200
Reviewed-by: Ilya Nikolaevskiy <ilnik@webrtc.org>
Commit-Queue: Ilya Nikolaevskiy <ilnik@webrtc.org>
Cr-Commit-Position: refs/heads/main@{#40747}
This commit is contained in:
Markus Handell 2023-09-14 01:31:11 +03:00 committed by WebRTC LUCI CQ
parent ec169a54a4
commit fb98b01061
2 changed files with 24 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
video/frame_cadence_adapter.cc
View File

@ -102,6 +102,7 @@ class ZeroHertzAdapterMode : public AdapterMode {
Clock* clock,
FrameCadenceAdapterInterface::Callback* callback,
double max_fps);
~ZeroHertzAdapterMode() { refresh_frame_requester_.Stop(); }
// Reconfigures according to parameters.
// All spatial layer trackers are initialized as unconverged by this method.

23
video/frame_cadence_adapter_unittest.cc
View File

@ -563,6 +563,29 @@ TEST(FrameCadenceAdapterTest, AcceptsUnconfiguredLayerFeedback) {
adapter->UpdateLayerStatus(2, false);
}
TEST(FrameCadenceAdapterTest, IgnoresDropInducedCallbacksPostDestruction) {
ZeroHertzFieldTrialEnabler enabler;
auto callback = std::make_unique<MockCallback>();
GlobalSimulatedTimeController time_controller(Timestamp::Zero());
auto queue = time_controller.GetTaskQueueFactory()->CreateTaskQueue(
"queue", TaskQueueFactory::Priority::NORMAL);
auto adapter = FrameCadenceAdapterInterface::Create(
time_controller.GetClock(), queue.get(), enabler);
queue->PostTask([&adapter, &callback] {
adapter->Initialize(callback.get());
adapter->SetZeroHertzModeEnabled(
FrameCadenceAdapterInterface::ZeroHertzModeParams{});
});
time_controller.AdvanceTime(TimeDelta::Zero());
constexpr int kMaxFps = 10;
adapter->OnConstraintsChanged(VideoTrackSourceConstraints{0, kMaxFps});
adapter->OnDiscardedFrame();
time_controller.AdvanceTime(TimeDelta::Zero());
callback = nullptr;
queue->PostTask([adapter = std::move(adapter)]() mutable {});
time_controller.AdvanceTime(3 * TimeDelta::Seconds(1) / kMaxFps);
}
class FrameCadenceAdapterSimulcastLayersParamTest
: public ::testing::TestWithParam<int> {
public: