generic-library/webrtc
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Fix a use-after-free when sending queued messages is aborted for blocked channel.

Browse Source 
BUG=4187
R=pthatcher@webrtc.org

Review URL: https://webrtc-codereview.appspot.com/39519004

git-svn-id: http://webrtc.googlecode.com/svn/trunk@8119 4adac7df-926f-26a2-2b94-8c16560cd09d
This commit is contained in:
jiayl@webrtc.org 2015-01-22 00:55:10 +00:00
parent e65d9d974c
commit cceb166a3f
2 changed files with 21 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
talk/app/webrtc/datachannel.cc
View File

@ -463,11 +463,13 @@ void DataChannel::SendQueuedDataMessages() {
ASSERT(was_ever_writable_ && state_ == kOpen);
while (!queued_send_data_.Empty()) {
rtc::scoped_ptr<DataBuffer> buffer(queued_send_data_.Front());
DataBuffer* buffer = queued_send_data_.Front();
if (!SendDataMessage(*buffer, false)) {
// Leave the message in the queue if sending is aborted.
break;
}
queued_send_data_.Pop();
delete buffer;
}
}

18
talk/app/webrtc/datachannel_unittest.cc
View File

@ -162,6 +162,24 @@ TEST_F(SctpDataChannelTest, QueuedDataSentWhenUnblocked) {
EXPECT_EQ(0U, webrtc_data_channel_->buffered_amount());
}
// Tests that no crash when the channel is blocked right away while trying to
// send queued data.
TEST_F(SctpDataChannelTest, BlockedWhenSendQueuedDataNoCrash) {
SetChannelReady();
webrtc::DataBuffer buffer("abcd");
provider_.set_send_blocked(true);
EXPECT_TRUE(webrtc_data_channel_->Send(buffer));
// Set channel ready while it is still blocked.
SetChannelReady();
EXPECT_EQ(buffer.size(), webrtc_data_channel_->buffered_amount());
// Unblock the channel to send queued data again, there should be no crash.
provider_.set_send_blocked(false);
SetChannelReady();
EXPECT_EQ(0U, webrtc_data_channel_->buffered_amount());
}
// Tests that the queued control message is sent when channel is ready.
TEST_F(SctpDataChannelTest, OpenMessageSent) {
// Initially the id is unassigned.