DescriptionThis looks like a clear case of "use-after-delete": Given DNS resolution
can take some time to complete, the re-use of a raw pointer stored as
member variable (Socket*) is likely to be the root cause of this crash.
This can happen is a socket is destroyed in between a call to "connect"
(or "send") and the DNS resolution callback is invoked.
Both the SocketConnectFunction and SocketSendFunction used to keep
a raw pointer to the Socket instance. A call to "destroy" at the
"right" time would free the socket instance, leaving both function
to access a released object.
The fix in this CL is to re-aquire the Socket instance using a
socket_id instead of re-using the Socket* instance. If the socket
has been destroyed, the socket_id is invalid, and the function fails
gracefully.
BUG=416741
Committed: https://crrev.com/d30fe32c54da4c5da9b50d91423d6e332b5c989d
Cr-Commit-Position: refs/heads/master@{#297076}
Patch Set 1 #
Messages
Total messages: 7 (2 generated)
|