commit 68f06af6f68c038fb9a1094951e0c7a0344a4db1
author Markus Handell <handellm@webrtc.org> Fri Nov 19 11:20:24 2021
committer WebRTC LUCI CQ <webrtc-scoped@luci-project-accounts.iam.gserviceaccount.com> Fri Nov 19 12:53:33 2021
tree 350852851d0f980877c0f013e5216069f609b4a9
parent 4be518d1fbbe0d624990130b7c47527a074f0cb1

WebRtcVideoChannelBaseTest.InvalidRecvBufferSize: fix UAF.

The test could cause a UAF as the test exits while the lambda is
still running. Only seems to happen on Linux for some reason.

Bug: webrtc:12854
Change-Id: Ie0c0de09b675ef93dc195a6470752a772083029e
Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/238425
Auto-Submit: Markus Handell <handellm@webrtc.org>
Commit-Queue: Tommi <tommi@webrtc.org>
Reviewed-by: Tommi <tommi@webrtc.org>
Cr-Commit-Position: refs/heads/main@{#35389}

media/engine/webrtc_video_engine_unittest.cc

diff --git a/media/engine/webrtc_video_engine_unittest.cc b/media/engine/webrtc_video_engine_unittest.cc
index 01ba354..7635bcc 100644
--- a/media/engine/webrtc_video_engine_unittest.cc
+++ b/media/engine/webrtc_video_engine_unittest.cc
@@ -1850,10 +1850,11 @@
     // This particular hack, pauses the transport controller TQ while we
     // change the field trial.
     rtc::TaskQueue* tq = call_->GetTransportControllerSend()->GetWorkerQueue();
-    rtc::Event waiting, resume;
-    tq->PostTask([&waiting, &resume]() {
+    rtc::Event waiting, resume, conclude;
+    tq->PostTask([&waiting, &resume, &conclude]() {
       waiting.Set();
       resume.Wait(rtc::Event::kForever);
+      conclude.Set();
     });
 
     waiting.Wait(rtc::Event::kForever);
@@ -1862,6 +1863,8 @@
 
     SetUp();
     resume.Set();
+    // Ensure we don't cause a UAF as the test scope exits.
+    conclude.Wait(rtc::Event::kForever);
 
     // OK, now the test can carry on.