)]}'
{
  "commit": "13fdb6e802e5c326533445aa15f9717f2fc26004",
  "tree": "e2bbcba4d87b0926135d66f1614ac2c9be3646cc",
  "parents": [
    "90b22181ec922900e26de71463b8e0ed47a5c2dd"
  ],
  "author": {
    "name": "Harald Alvestrand",
    "email": "hta@webrtc.org",
    "time": "Tue Apr 21 14:59:35 2026"
  },
  "committer": {
    "name": "webrtc-scoped@luci-project-accounts.iam.gserviceaccount.com",
    "email": "webrtc-scoped@luci-project-accounts.iam.gserviceaccount.com",
    "time": "Tue Apr 21 20:42:27 2026"
  },
  "message": "pc: fix use-after-free in AllocateSctpSids\n\nAllocateSctpSids iterates over newly assigned channels using raw\npointers and calls OnTransportReady on each one. OnTransportReady\ncan synchronously fail (e.g. if sending the DCEP OPEN message\nfails), which may cause the channel to close and be deleted,\nleaving the controller with a dangling pointer.\n\nThis change ensures the channels are kept alive during the loop by\nusing scoped_refptr for the temporary collection. This fixes the\nUAF for any failure mode that prevents synchronous sending of the\ninitialization message.\n\nBug: chromium:503422316\nChange-Id: I1b927386fb4ed4279036835a244320aba6acf875\nReviewed-on: https://webrtc-review.googlesource.com/c/src/+/465701\nCommit-Queue: Harald Alvestrand \u003chta@webrtc.org\u003e\nAuto-Submit: Harald Alvestrand \u003chta@webrtc.org\u003e\nReviewed-by: Danil Chapovalov \u003cdanilchap@webrtc.org\u003e\nCr-Commit-Position: refs/heads/main@{#47503}\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "09b62cd4dea1ad006fd32cf41b0bba87f22b81c1",
      "old_mode": 33188,
      "old_path": "pc/data_channel_controller.cc",
      "new_id": "8b426070f974261b7a02e47a8d9f792fbbb27f88",
      "new_mode": 33188,
      "new_path": "pc/data_channel_controller.cc"
    },
    {
      "type": "modify",
      "old_id": "fa04960cf314c0184d5b5483699eb94c68e4e95e",
      "old_mode": 33188,
      "old_path": "pc/data_channel_controller_unittest.cc",
      "new_id": "9089df8e10ce048d319b8c46be8bfd507d2d4b2e",
      "new_mode": 33188,
      "new_path": "pc/data_channel_controller_unittest.cc"
    }
  ]
}