824220 - Constraints should be passed from calling thread to SIPCC thread using a pointer

Status: RESOLVED FIXED

(Core :: WebRTC: Signaling, defect, P1)

Description

[Adam Roach [:abr]]

Currently, the cc_invokeFeatureSDPMode function in cc_call_feature.c generates a random number as an index into a global hash table for storing offer and answer constraints. This isn't the most architecturally sound way of handling data passing. This bug is a memento to clean up this handling so that a pointer is passed directly via the callFeature.featData.ccData structure rather than indirectly by way of the hash table.

Comment 1

[Randell Jesup [:jesup] (needinfo me)]

This hash table can be accessed from two threads in a non-safe manner, per abr:

	abr	(The problem is that the hashtable is not synchronized, and it's being modified by two different threads)
	abr	I'm not clear about whether this is the kind of issue that we should mark a bug as security sensitive for. But as long as it's in the open, I'm hesitant to add any comments about the potential for crashes.
	abr	It should, in any case, be an easy fix, and it might stave off some of the fuzzer-generated bugs that appear to be popping up with some rapdity.

Comment 2

[Adam Roach [:abr]]

Attachment: Pass constraints through directly through message, deallocate when done

Comment 3

[Adam Roach [:abr]]

Attachment: Pass constraints through directly through message, deallocate when done

Comment 4

[Randell Jesup [:jesup] (needinfo me)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/35a0599d087a

Comment 5

[Mats Palmgren (inactive)]

http://hg.mozilla.org/mozilla-central/rev/35a0599d087a