Avoid UAF on ConnectionFilter impls

Avoid UAF on ConnectionFilter impls

An incoming service connection may outlive any ConnectionFilter
which added interfaces to it, so a ConnectionFilter impl must not
register any interface binders which hold unsafe references to
itself.

This fixes cases where that was being done.

BUG=639650
TBR=ben@chromium.org

Committed: https://crrev.com/c6d602efe29592458c78ca2204450dbb5126751f
Cr-Commit-Position: refs/heads/master@{#413462}

[Ken Rockot(use gerrit already), 2016-08-22 16:30:36]

The CQ bit was checked by rockot@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-08-22 16:31:08]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[Ken Rockot(use gerrit already), 2016-08-22 16:37:03]

The alternative would be to ensure ConnectionFilters live at least as long as
the connections they service, but given that users may remove filters at any
time that becomes quite complicated and would probably mean making them
refcounted.

[Ken Rockot(use gerrit already), 2016-08-22 16:37:10]

The CQ bit was checked by rockot@chromium.org

[commit-bot: I haz the power, 2016-08-22 16:37:41]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-08-22 17:22:24]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2016-08-22 17:23:39]

Description was changed from

==========
Avoid UAF on ConnectionFilter impls

An incoming service connection may outlive any ConnectionFilter
which added interfaces to it, so a ConnectionFilter impl must not
register any interface binders which hold unsafe references to
itself.

This fixes cases where that was being done.

BUG=639650
TBR=ben@chromium.org
==========

to

==========
Avoid UAF on ConnectionFilter impls

An incoming service connection may outlive any ConnectionFilter
which added interfaces to it, so a ConnectionFilter impl must not
register any interface binders which hold unsafe references to
itself.

This fixes cases where that was being done.

BUG=639650
TBR=ben@chromium.org

Committed: https://crrev.com/c6d602efe29592458c78ca2204450dbb5126751f
Cr-Commit-Position: refs/heads/master@{#413462}
==========

[commit-bot: I haz the power, 2016-08-22 17:23:40]

Patchset 1 (id:??) landed as
https://crrev.com/c6d602efe29592458c78ca2204450dbb5126751f
Cr-Commit-Position: refs/heads/master@{#413462}