From 3da25770384751ef09e29654d048e4d284ebdf76 Mon Sep 17 00:00:00 2001 From: Markus Handell Date: Fri, 5 Nov 2021 16:48:38 +0100 Subject: [PATCH] BandwidthEndToEndTest.RembWithSendSideBwe: fix UAF. The test has a ModuleRtpRtcpImpl2 which is destroyed long after test transports are removed, leading to a UAF. Fix by overriding OnStreamsStopped which is called before transports are removed. TESTED=Asan now passes 1000/1000, failed 4/1000 before. Fixed: chromium:1235251, b:192567426 Change-Id: Ie9135685e81712e38c4b00355debfc67c1f603bd Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/237345 Reviewed-by: Stefan Holmer Reviewed-by: Sergey Silkin Commit-Queue: Stefan Holmer Cr-Commit-Position: refs/heads/main@{#35318} --- video/end_to_end_tests/bandwidth_tests.cc | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/video/end_to_end_tests/bandwidth_tests.cc b/video/end_to_end_tests/bandwidth_tests.cc index 3d1e61be37..25e9478abf 100644 --- a/video/end_to_end_tests/bandwidth_tests.cc +++ b/video/end_to_end_tests/bandwidth_tests.cc @@ -204,12 +204,7 @@ TEST_F(BandwidthEndToEndTest, RembWithSendSideBwe) { retransmission_rate_limiter_(clock_, 1000), task_queue_(task_queue) {} - ~BweObserver() override { - // Block until all already posted tasks run to avoid races when such task - // accesses `this`. Also make sure we free `rtp_rtcp_` on the correct - // thread/task queue. - SendTask(RTC_FROM_HERE, task_queue_, [this]() { rtp_rtcp_ = nullptr; }); - } + void OnStreamsStopped() override { rtp_rtcp_ = nullptr; } std::unique_ptr CreateReceiveTransport( TaskQueueBase* task_queue) override {