webrtc/datachannel: fix use-after-free in sctp state notification 85/273285/2
authorMatthew Waters <matthew@centricular.com>
Fri, 26 Nov 2021 11:11:06 +0000 (22:11 +1100)
committerSangchul Lee <sc11.lee@samsung.com>
Fri, 1 Apr 2022 13:38:11 +0000 (22:38 +0900)
commitadb2aa42c5d7b89b1790c605257a958e7aca94c5
treedea76f5c76d0a23163fc37830082c6a75e0b0878
parent430a7a7ccfe3301bf4d2a2d129257b45f8ca260a
webrtc/datachannel: fix use-after-free in sctp state notification

g_signal_disconnect*() doesn't stop any existing callbacks from running
which means that if the notify::state callback is in progress in one
thread and the data channel object is finalize()ed in another thread,
then there could be a use-after-free trying lock the data channel
object.

We can't reasonably use a GWeakRef as we don't have a 'parent' object to
free the GWeakRef after the data channel is finalized.  This is also
complicated by the fact that the application can hold a reference to the
data channel object that would live beyond the lifetime of webrtcbin
itself.

We solve this by implementing a ghetto weak-ref solution internally with
a list of outstanding data channels.

Change-Id: Id901ca1cbd3edf1a9b9337a65b414d91c803cc3c
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/1664>
subprojects/gst-plugins-bad/ext/webrtc/webrtcdatachannel.c
subprojects/gst-plugins-bad/gst-libs/gst/webrtc/datachannel.c