mollyim/webrtc
1
0
Fork 0
mirror of https://github.com/mollyim/webrtc.git synced 2025-05-19 00:27:51 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix UAF in VideoSendStreamTest.MinTransmitBitrateRespectsRemb

Browse source 
From when callTest's send_transport_ is deleted and until the test is
completely ended, there is a possibility that the background task
webrtc::ModuleRtpRtcpImpl2::MaybeSendRtcpAtOrAfterTimestamp
will call send_transport_ which has already been deleted.

Fix this by deleting rtp_rtcp_ before send_transport_ is deleted.

Bug: webrtc:14202
Change-Id: Ief96c4712875beb55ef232a8bce990d1e9e9efe1
Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/266300
Reviewed-by: Erik Språng <sprang@webrtc.org>
Commit-Queue: Daniel.L (Byoungchan) Lee <daniel.l@hpcnt.com>
Cr-Commit-Position: refs/heads/main@{#37633}
This commit is contained in:
Byoungchan Lee 2022-07-28 10:15:46 +09:00 committed by WebRTC LUCI CQ
parent 275e2683b3
commit 82f359e45d
1 changed files with 4 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
video/video_send_stream_tests.cc
View file

@ -1487,11 +1487,6 @@ TEST_F(VideoSendStreamTest, MinTransmitBitrateRespectsRemb) {
bitrate_capped_(false),
task_safety_flag_(PendingTaskSafetyFlag::CreateDetached()) {}
~BitrateObserver() override {
// Make sure we free `rtp_rtcp_` in the same context as we constructed it.
SendTask(RTC_FROM_HERE, task_queue_, [this]() { rtp_rtcp_ = nullptr; });
}
private:
Action OnSendRtp(const uint8_t* packet, size_t length) override {
if (IsRtcpPacket(rtc::MakeArrayView(packet, length)))
@ -1547,7 +1542,10 @@ TEST_F(VideoSendStreamTest, MinTransmitBitrateRespectsRemb) {
encoder_config->min_transmit_bitrate_bps = kMinTransmitBitrateBps;
}
void OnStreamsStopped() override { task_safety_flag_->SetNotAlive(); }
void OnStreamsStopped() override {
task_safety_flag_->SetNotAlive();
rtp_rtcp_.reset();
}
void PerformTest() override {
EXPECT_TRUE(Wait())