Fix: use-after-free after ClientNetworkCoordinatorSocketHandler::CloseAllConnections() (#9534)
The function clears all stun-handlers. This causes all of those objects to be destroyed. A handler can have a pending connecter, which was only killed in case CloseConnection() was called. This is never the case when the object is destroyed. In result, the connecter could finish and cause a use-after-free by calling into the (now deleted) handler.
This commit is contained in:
@@ -30,6 +30,7 @@ public:
|
||||
ClientNetworkTurnSocketHandler(const std::string &token, uint8 tracking_number, const std::string &connection_string) : token(token), tracking_number(tracking_number), connection_string(connection_string) {}
|
||||
|
||||
NetworkRecvStatus CloseConnection(bool error = true) override;
|
||||
~ClientNetworkTurnSocketHandler() override;
|
||||
void SendReceive();
|
||||
|
||||
void Connect();
|
||||
|
Reference in New Issue
Block a user