Closed Bug 824220 Opened 7 years ago Closed 7 years ago
Constraints should be passed from calling thread to SIPCC thread using a pointer
Currently, the cc_invokeFeatureSDPMode function in cc_call_feature.c generates a random number as an index into a global hash table for storing offer and answer constraints. This isn't the most architecturally sound way of handling data passing. This bug is a memento to clean up this handling so that a pointer is passed directly via the callFeature.featData.ccData structure rather than indirectly by way of the hash table.
This hash table can be accessed from two threads in a non-safe manner, per abr: abr (The problem is that the hashtable is not synchronized, and it's being modified by two different threads) abr I'm not clear about whether this is the kind of issue that we should mark a bug as security sensitive for. But as long as it's in the open, I'm hesitant to add any comments about the potential for crashes. abr It should, in any case, be an easy fix, and it might stave off some of the fuzzer-generated bugs that appear to be popping up with some rapdity.
Severity: normal → critical
Priority: -- → P1
Whiteboard: [WebRTC] → [WebRTC][blocking-webrtc+]
Attachment #696115 - Flags: review?(rjesup) → review+
Target Milestone: --- → mozilla20
Status: ASSIGNED → RESOLVED
Closed: 7 years ago
Resolution: --- → FIXED
Attachment #696115 - Flags: checkin?(rjesup) → checkin+
Whiteboard: [WebRTC][blocking-webrtc+] → [WebRTC][blocking-webrtc+][qa-]
Whiteboard: [WebRTC][blocking-webrtc+][qa-] → [WebRTC][blocking-webrtc+][qa-][adv-main20-]
You need to log in before you can comment on or make changes to this bug.