webrtc/datachannel: fix use-after-free in sctp state notification
authorMatthew Waters <matthew@centricular.com>
Fri, 26 Nov 2021 11:11:06 +0000 (22:11 +1100)
committerGStreamer Marge Bot <gitlab-merge-bot@gstreamer-foundation.org>
Tue, 29 Mar 2022 23:55:40 +0000 (23:55 +0000)
commit5741ee38e0afe9d981bdb56a5da7dd46d16c1ba2
tree6c43ad2cbbc29a886a1bc86bcf336ae47f7b58f4
parent831b34fb43347d2fd8973774501b2dd3c140aaa7
webrtc/datachannel: fix use-after-free in sctp state notification

g_signal_disconnect*() doesn't stop any existing callbacks from running
which means that if the notify::state callback is in progress in one
thread and the data channel object is finalize()ed in another thread,
then there could be a use-after-free trying lock the data channel
object.

We can't reasonably use a GWeakRef as we don't have a 'parent' object to
free the GWeakRef after the data channel is finalized.  This is also
complicated by the fact that the application can hold a reference to the
data channel object that would live beyond the lifetime of webrtcbin
itself.

We solve this by implementing a ghetto weak-ref solution internally with
a list of outstanding data channels.

Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/1664>
subprojects/gst-plugins-bad/ext/webrtc/webrtcdatachannel.c
subprojects/gst-plugins-bad/gst-libs/gst/webrtc/datachannel.c