-
Notifications
You must be signed in to change notification settings - Fork 187
media: fix heap-use-after-free in CobaltAudioRendererSink #9035
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Conversation
Use std::unique_ptr with a custom deleter for SbAudioSink to ensure the audio sink is properly destroyed when CobaltAudioRendererSink is destroyed. This prevents background ALSA threads from accessing the freed sink object. Fixes an ASAN error where UpdateSourceStatus was called on a freed CobaltAudioRendererSink instance. Bug: 483384414 Issue: 483384414
🤖 Gemini Suggested Commit Message💡 Pro Tips for a Better Commit Message:
|
|
/gemini review |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Code Review
This pull request effectively resolves a heap-use-after-free vulnerability in CobaltAudioRendererSink by employing a std::unique_ptr with a custom deleter to manage the lifecycle of SbAudioSink. This change correctly applies the RAII principle to ensure the audio sink is always deallocated, even in error paths or during object destruction. The implementation is solid and directly addresses the issue. I have one suggestion to introduce a type alias for the unique_ptr, which would improve code readability and maintainability.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Code Review
This pull request effectively addresses a heap-use-after-free bug by managing the SbAudioSink lifecycle with a std::unique_ptr and a custom deleter. This is a solid approach to ensure proper resource management. My review includes a few suggestions to align the implementation more closely with idiomatic C++ practices for handling C-style opaque pointers with smart pointers, which will improve code clarity and maintainability.
Refactor CobaltAudioRendererSink to manage SbAudioSink lifecycle
with std::unique_ptr and a custom deleter. This guarantees proper
destruction of the audio sink when the renderer sink is destroyed or
reset.
This change prevents background ALSA threads from accessing a freed
SbAudioSink object, addressing a heap-use-after-free ASAN error seen
when UpdateSourceStatus was called on a freed instance.
Issue: 483384414