diff options
| author | Harald Alvestrand <hta@chromium.org> | 2021-01-20 10:23:07 +0000 |
|---|---|---|
| committer | Michael Brüning <michael.bruning@qt.io> | 2021-03-29 09:43:40 +0000 |
| commit | 71b72721f644be8cd92f5d3f2245f65993799f56 (patch) | |
| tree | a44cb6c49c85017ee2c8d3ae2f9d26182f16b290 | |
| parent | f2f8da5d330489c0de4239eea994a7ad9e62709e (diff) | |
[Backport] CVE-2021-21191: Use after free in WebRTC
Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/2639893:
Iterate more carefully over DTLS transports at close
Ensure that even if the set of DTLS transports is modified during
callbacks called from close, the process will be well-defined.
Bug: chromium:1167357
Change-Id: I712280e7382a647027912178156127831b437f75
Reviewed-by: Henrik Boström <hbos@chromium.org>
Commit-Queue: Harald Alvestrand <hta@chromium.org>
Cr-Commit-Position: refs/heads/master@{#845122}
Reviewed-by: Jüri Valdmann <juri.valdmann@qt.io>
| -rw-r--r-- | chromium/third_party/blink/renderer/modules/peerconnection/rtc_peer_connection.cc | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/chromium/third_party/blink/renderer/modules/peerconnection/rtc_peer_connection.cc b/chromium/third_party/blink/renderer/modules/peerconnection/rtc_peer_connection.cc index fd5dff1a56b..7ede07459f1 100644 --- a/chromium/third_party/blink/renderer/modules/peerconnection/rtc_peer_connection.cc +++ b/chromium/third_party/blink/renderer/modules/peerconnection/rtc_peer_connection.cc @@ -3521,8 +3521,14 @@ void RTCPeerConnection::CloseInternal() { if (sctp_transport_) { sctp_transport_->Close(); } - for (auto& dtls_transport_iter : dtls_transports_by_native_transport_) { - dtls_transport_iter.value->Close(); + // Since Close() can trigger JS-level callbacks, iterate over a copy + // of the transports list. + auto dtls_transports_copy = dtls_transports_by_native_transport_; + for (auto& dtls_transport_iter : dtls_transports_copy) { + // Since "value" is a WeakPtr, check if it's still valid. + if (dtls_transport_iter.value) { + dtls_transport_iter.value->Close(); + } } feature_handle_for_scheduler_.reset(); |