Fix: use-after-free after ClientNetworkCoordinatorSocketHandler::CloseAllConnections() (#9534)

The function clears all stun-handlers. This causes all of those
objects to be destroyed.
A handler can have a pending connecter, which was only killed in
case CloseConnection() was called. This is never the case when
the object is destroyed. In result, the connecter could finish
and cause a use-after-free by calling into the (now deleted)
handler.
This commit is contained in:
Patric Stout
2021-09-05 18:17:39 +02:00
committed by GitHub
parent 9c74dc2468
commit f656b0ae96
4 changed files with 20 additions and 6 deletions

View File

@@ -30,6 +30,7 @@ public:
ClientNetworkTurnSocketHandler(const std::string &token, uint8 tracking_number, const std::string &connection_string) : token(token), tracking_number(tracking_number), connection_string(connection_string) {}
NetworkRecvStatus CloseConnection(bool error = true) override;
~ClientNetworkTurnSocketHandler() override;
void SendReceive();
void Connect();