Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(1272)

Issue 608083002: Fix crash in deprecated Socket API. (Closed)

Created:
6 years, 2 months ago by rpaquay
Modified:
6 years, 2 months ago
CC:
chromium-reviews, chromium-apps-reviews_chromium.org, extensions-reviews_chromium.org
Base URL:
https://chromium.googlesource.com/chromium/src.git@master
Project:
chromium
Visibility:
Public.

Description

This looks like a clear case of "use-after-delete": Given DNS resolution can take some time to complete, the re-use of a raw pointer stored as member variable (Socket*) is likely to be the root cause of this crash. This can happen is a socket is destroyed in between a call to "connect" (or "send") and the DNS resolution callback is invoked. Both the SocketConnectFunction and SocketSendFunction used to keep a raw pointer to the Socket instance. A call to "destroy" at the "right" time would free the socket instance, leaving both function to access a released object. The fix in this CL is to re-aquire the Socket instance using a socket_id instead of re-using the Socket* instance. If the socket has been destroyed, the socket_id is invalid, and the function fails gracefully. BUG=416741 Committed: https://crrev.com/d30fe32c54da4c5da9b50d91423d6e332b5c989d Cr-Commit-Position: refs/heads/master@{#297076}

Patch Set 1 #

Unified diffs Side-by-side diffs Delta from patch set Stats (+35 lines, -23 lines) Patch
M extensions/browser/api/socket/socket_api.h View 2 chunks +0 lines, -2 lines 0 comments Download
M extensions/browser/api/socket/socket_api.cc View 6 chunks +35 lines, -21 lines 0 comments Download

Messages

Total messages: 7 (2 generated)
rpaquay
6 years, 2 months ago (2014-09-26 23:02:37 UTC) #2
Ken Rockot(use gerrit already)
Ah, pretty straightforward. LGTM
6 years, 2 months ago (2014-09-26 23:04:30 UTC) #3
commit-bot: I haz the power
CQ is trying da patch. Follow status at https://chromium-cq-status.appspot.com/patch-status/608083002/1
6 years, 2 months ago (2014-09-26 23:06:53 UTC) #5
commit-bot: I haz the power
Committed patchset #1 (id:1) as 691213ebccf7d8983e844b8751a82668e5c0b6c9
6 years, 2 months ago (2014-09-26 23:55:59 UTC) #6
commit-bot: I haz the power
6 years, 2 months ago (2014-09-26 23:56:36 UTC) #7
Message was sent while issue was closed.
Patchset 1 (id:??) landed as
https://crrev.com/d30fe32c54da4c5da9b50d91423d6e332b5c989d
Cr-Commit-Position: refs/heads/master@{#297076}

Powered by Google App Engine
This is Rietveld 408576698