858644 - WebRTC TURN use-after-free crash [@nr_turn_stun_ctx_start]

Status: RESOLVED FIXED

(Core :: WebRTC: Signaling, defect)

Description

[Christoph Diehl [:posidron]]

Attachment: callstack

This happened while running the IceGatherTest.TestGatherTurn test.

alloc: media/mtransport/third_party/nICEr/src/stun/turn_client_ctx.c:99

  if (!(sctx=RCALLOC(sizeof(nr_turn_stun_ctx))))
    ABORT(R_NO_MEMORY);


free: media/mtransport/third_party/nICEr/src/stun/turn_client_ctx.c:371

  /* Setting these alues to 0 isn't strictly necessary, but
     it protects us in case we double cancel and for
     some reason bungle the states above in future.*/

  RFREE(ctx->label);
  ctx->label = 0; 


re-use: media/mtransport/third_party/nICEr/src/stun/turn_client_ctx.c:196

  if ((r=nr_stun_client_reset(ctx->stun))) {
    r_log(NR_LOG_TURN, LOG_ERR, "TURN(%s): Couldn't reset STUN",
          ctx->tctx->label);
    ABORT(r);


Tested with m-i rev 8262a337d5be and with the patch of bug 786235.

Comment 1

[Eric Rescorla (:ekr)]

cdiehl:
Can you please retry with the latest patch. I moved this free...

Comment 2

[Eric Rescorla (:ekr)]

Hmm.... I actually didn't upload that patch yet....

Comment 3

[Christoph Diehl [:posidron]]

This seems to be fixed with the updated patch https://bugzilla.mozilla.org/show_bug.cgi?id=786235#c18