Changeset 142887 in webkit

Timestamp:

Feb 14, 2013, 9:47:36 AM (12 years ago)

Author:

tommyw@google.com

Message:

MediaStream API: RTCDataChannel triggers a use-after-free
​https://bugs.webkit.org/show_bug.cgi?id=109806

Reviewed by Adam Barth.

Making sure RTCPeerConnection::stop() is always called at least once.
Also making sure that RTCDataChannels state gets set to Closed correctly.

Hard to test in WebKit but covered by Chromium tests.

• Modules/mediastream/RTCDataChannel.cpp:

(WebCore::RTCDataChannel::stop):

• Modules/mediastream/RTCPeerConnection.cpp:

(WebCore::RTCPeerConnection::~RTCPeerConnection):
(WebCore::RTCPeerConnection::stop):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• Modules/mediastream/RTCDataChannel.cpp (modified) (1 diff)
• Modules/mediastream/RTCPeerConnection.cpp (modified) (2 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2013-02-14  Tommy Widenflycht  <tommyw@google.com>
+
+        MediaStream API: RTCDataChannel triggers a use-after-free
+        https://bugs.webkit.org/show_bug.cgi?id=109806
+
+        Reviewed by Adam Barth.
+
+        Making sure RTCPeerConnection::stop() is always called at least once.
+        Also making sure that RTCDataChannels state gets set to Closed correctly.
+
+        Hard to test in WebKit but covered by Chromium tests.
+
+        * Modules/mediastream/RTCDataChannel.cpp:
+        (WebCore::RTCDataChannel::stop):
+        * Modules/mediastream/RTCPeerConnection.cpp:
+        (WebCore::RTCPeerConnection::~RTCPeerConnection):
+        (WebCore::RTCPeerConnection::stop):
+
 2013-02-14  Vsevolod Vlasov  <vsevik@chromium.org>
 

trunk/Source/WebCore/Modules/mediastream/RTCDataChannel.cpp

@@ -244 +244 @@
 {
     m_stopped = true;
+    m_readyState = ReadyStateClosed;
     m_handler->setClient(0);
     m_scriptExecutionContext = 0;

trunk/Source/WebCore/Modules/mediastream/RTCPeerConnection.cpp

@@ -163 +163 @@
 RTCPeerConnection::~RTCPeerConnection()
 {
+    stop();
 }
 
@@ -591 +592 @@
 void RTCPeerConnection::stop()
 {
+    if (m_stopped)
+        return;
+
     m_stopped = true;
     m_iceConnectionState = IceConnectionStateClosed;