webrtc: Fix possible use-after-free of GstWebRTCICETransport
authorJohan Sternerup <johast@axis.com>
Thu, 1 Dec 2022 12:28:16 +0000 (13:28 +0100)
committerGStreamer Marge Bot <gitlab-merge-bot@gstreamer-foundation.org>
Fri, 2 Dec 2022 03:37:29 +0000 (03:37 +0000)
commit4b96294f19e5f6f6423e1a08119b443d7fa6ab13
tree246365a218c0e3750912bd3b3c54d80346d5fac0
parent38f6a0ba2e2152135a4c102048de9288b87b35d4
webrtc: Fix possible use-after-free of GstWebRTCICETransport

Because of the asynchronous resolving of mDNS ICE candidates it is
possible that GstWebRTCICE outlives webrtcbin. This in turn prolongs
the lifetime of the GstWebRTCNiceStream objects via refs in
nice_stream_map. Thus the GstWebRTCICETransport objects held in
GstWebRTCNiceStream may be invalid at the time they are accessed by
the _on_candidate_gathering_done() callback since GstWebRTCNiceStream
doesn't take a reference to them. Doing so would create a circular
reference, so instead this commit introduces weak references to the
transport objects and then we can check if the objects are valid before
accessing them.

Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/3502>
subprojects/gst-plugins-bad/gst-libs/gst/webrtc/nice/nicestream.c