Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(406)

Issue 1071063005: Fix heap-use-after-free issue with WebAudioCapturerSource. (Closed)

Created:
5 years, 8 months ago by Guido Urdaneta
Modified:
5 years, 8 months ago
CC:
chromium-reviews, mlamouri+watch-content_chromium.org, posciak+watch_chromium.org, jam, mcasas+watch_chromium.org, feature-media-reviews_chromium.org, darin-cc_chromium.org, mkwst+moarreviews-renderer_chromium.org, wjia+watch_chromium.org, tommi (sloooow) - chröme
Base URL:
https://chromium.googlesource.com/chromium/src.git@master
Target Ref:
refs/pending/heads/master
Project:
chromium
Visibility:
Public.

Description

Fix heap-use-after-free issue with WebAudioCapturerSource. WebAudioCapturerSource registers with a blink WebMediaStreamSource. When the audio track was stopped, the WebAudioCapturerSource was destroyed and the WebMediaStreamSource was left with a dangling pointer, which it tried to use, resulting in access to freed memory and usually a crashed tab. This CL makes WebAudioCapturerSource aware of the WebMediaStreamSource with which it is registered, so that it can be deregistered when the audio track is stopped. BUG=473253 TEST=See testcase.html in crbug.com/473253 Committed: https://crrev.com/228cd9447121ede4d32ab48c8dfe066736cfdae2 Cr-Commit-Position: refs/heads/master@{#324622}

Patch Set 1 #

Total comments: 2

Patch Set 2 : Minor style fix #

Patch Set 3 : Improvements in comments, as suggested by henrika@ #

Patch Set 4 : Improvements in the comments, as suggested by henrika@ #

Total comments: 1

Patch Set 5 : Add thread check to WebAudioCapturerSourcer destructor #

Unified diffs Side-by-side diffs Delta from patch set Stats (+31 lines, -4 lines) Patch
M content/renderer/media/webaudio_capturer_source.h View 1 2 4 chunks +11 lines, -1 line 0 comments Download
M content/renderer/media/webaudio_capturer_source.cc View 1 2 3 4 3 chunks +19 lines, -2 lines 0 comments Download
M content/renderer/media/webrtc/peer_connection_dependency_factory.cc View 1 chunk +1 line, -1 line 0 comments Download

Messages

Total messages: 14 (4 generated)
Guido Urdaneta
5 years, 8 months ago (2015-04-09 11:46:49 UTC) #2
henrika (OOO until Aug 14)
Nice work Guido. Some initial comments. https://codereview.chromium.org/1071063005/diff/1/content/renderer/media/webaudio_capturer_source.cc File content/renderer/media/webaudio_capturer_source.cc (right): https://codereview.chromium.org/1071063005/diff/1/content/renderer/media/webaudio_capturer_source.cc#newcode123 content/renderer/media/webaudio_capturer_source.cc:123: void WebAudioCapturerSource::removeFromBlinkSource() { ...
5 years, 8 months ago (2015-04-09 11:53:40 UTC) #4
Guido Urdaneta
Note that I added a private method to WebAudioCapturerSource to deregister the WebAudioCapturerSource from blink, ...
5 years, 8 months ago (2015-04-09 13:10:54 UTC) #5
henrika (OOO until Aug 14)
I think perkj@ is more suitable to answer your question. If your version solves the ...
5 years, 8 months ago (2015-04-09 13:16:34 UTC) #6
perkj_chrome
https://codereview.chromium.org/1071063005/diff/60001/content/renderer/media/webaudio_capturer_source.cc File content/renderer/media/webaudio_capturer_source.cc (right): https://codereview.chromium.org/1071063005/diff/60001/content/renderer/media/webaudio_capturer_source.cc#newcode30 content/renderer/media/webaudio_capturer_source.cc:30: removeFromBlinkSource(); On what thread is this object destroyed? I ...
5 years, 8 months ago (2015-04-09 14:55:49 UTC) #7
Guido Urdaneta
On 2015/04/09 14:55:49, perkj wrote: > https://codereview.chromium.org/1071063005/diff/60001/content/renderer/media/webaudio_capturer_source.cc > File content/renderer/media/webaudio_capturer_source.cc (right): > > https://codereview.chromium.org/1071063005/diff/60001/content/renderer/media/webaudio_capturer_source.cc#newcode30 > ...
5 years, 8 months ago (2015-04-10 10:56:38 UTC) #8
perkj_chrome
thanks lgtm I think you should keep the cls separate.
5 years, 8 months ago (2015-04-10 12:31:55 UTC) #9
commit-bot: I haz the power
CQ is trying da patch. Follow status at https://chromium-cq-status.appspot.com/patch-status/1071063005/80001
5 years, 8 months ago (2015-04-10 12:57:56 UTC) #12
commit-bot: I haz the power
Committed patchset #5 (id:80001)
5 years, 8 months ago (2015-04-10 13:00:47 UTC) #13
commit-bot: I haz the power
5 years, 8 months ago (2015-04-10 13:01:39 UTC) #14
Message was sent while issue was closed.
Patchset 5 (id:??) landed as
https://crrev.com/228cd9447121ede4d32ab48c8dfe066736cfdae2
Cr-Commit-Position: refs/heads/master@{#324622}

Powered by Google App Engine
This is Rietveld 408576698