Fix: use-after-free after ClientNetworkCoordinatorSocketHandler::CloseAllConnections() (#9534)

The function clears all stun-handlers. This causes all of those
objects to be destroyed.
A handler can have a pending connecter, which was only killed in
case CloseConnection() was called. This is never the case when
the object is destroyed. In result, the connecter could finish
and cause a use-after-free by calling into the (now deleted)
handler.
This commit is contained in:
Patric Stout
2021-09-05 18:17:39 +02:00
committed by GitHub
parent 9c74dc2468
commit f656b0ae96
4 changed files with 20 additions and 6 deletions

View File

@@ -24,6 +24,7 @@ public:
NetworkAddress local_addr; ///< Local addresses of the socket.
NetworkRecvStatus CloseConnection(bool error = true) override;
~ClientNetworkStunSocketHandler() override;
void SendReceive();
void Connect(const std::string &token, uint8 family);