Skip to content

Commit

Permalink
Fix botguard crosstool test failure
Browse files Browse the repository at this point in the history
Bug:
In url_request_context.cc, we reset proxy_resolution_service_. However,
in http_network_session, we store the original proxy_resolution_service_.
From url_request_context.cc, if we delete the orignal proxy_resolution_service
and create a new object, http_network_session may still try to access
the orignal object. This will trigger the heap-use-after-free error.

b/346555722
  • Loading branch information
sherryzy committed Jun 13, 2024
1 parent 58e93f7 commit bea860a
Show file tree
Hide file tree
Showing 4 changed files with 35 additions and 11 deletions.
16 changes: 11 additions & 5 deletions cobalt/network/url_request_context.cc
Original file line number Diff line number Diff line change
Expand Up @@ -317,11 +317,17 @@ std::unique_ptr<net::URLRequest> URLRequestContext::CreateRequest(
void URLRequestContext::SetProxy(const std::string& proxy_rules) {
net::ProxyConfig proxy_config = CreateCustomProxyConfig(proxy_rules);
// ProxyService takes ownership of the ProxyConfigService.
url_request_context_->set_proxy_resolution_service(
net::ConfiguredProxyResolutionService::CreateUsingSystemProxyResolver(
std::make_unique<ProxyConfigService>(proxy_config),
net::NetLog::Get(),
/*quick_check_enabled=*/true));
auto proxy_config_service =
std::make_unique<ProxyConfigService>(proxy_config);
net::ConfiguredProxyResolutionService* proxy_configured_resolution_service =
nullptr;
bool success = url_request_context_->proxy_resolution_service()
->CastToConfiguredProxyResolutionService(
&proxy_configured_resolution_service);
if (success) {
proxy_configured_resolution_service->ResetConfigService(
std::move(proxy_config_service));
}
}

void URLRequestContext::SetEnableQuic(bool enable_quic) {
Expand Down
19 changes: 19 additions & 0 deletions net/proxy_resolution/configured_proxy_resolution_service.cc
Original file line number Diff line number Diff line change
Expand Up @@ -791,6 +791,25 @@ ConfiguredProxyResolutionService::ConfiguredProxyResolutionService(
config_service_->AddObserver(this);
}

#if defined(STARBOARD)
void ConfiguredProxyResolutionService::ResetConfigService(
std::unique_ptr<ProxyConfigService> new_proxy_config_service) {
DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
State previous_state = ResetProxyConfig(true);

// Release the old configuration service.
if (config_service_.get())
config_service_->RemoveObserver(this);

// Set the new configuration service.
config_service_.reset(new_proxy_config_service.release());
config_service_->AddObserver(this);

if (previous_state != STATE_NONE)
ApplyProxyConfigIfAvailable();
}
#endif

// static
std::unique_ptr<ConfiguredProxyResolutionService>
ConfiguredProxyResolutionService::CreateUsingSystemProxyResolver(
Expand Down
5 changes: 5 additions & 0 deletions net/proxy_resolution/configured_proxy_resolution_service.h
Original file line number Diff line number Diff line change
Expand Up @@ -177,6 +177,11 @@ class NET_EXPORT ConfiguredProxyResolutionService
// ProxyResolutionService
base::Value::Dict GetProxyNetLogValues() override;

#if defined(STARBOARD)
void ResetConfigService(
std::unique_ptr<ProxyConfigService> new_proxy_config_service);
#endif

// ProxyResolutionService
[[nodiscard]] bool CastToConfiguredProxyResolutionService(
ConfiguredProxyResolutionService** configured_proxy_resolution_service)
Expand Down
6 changes: 0 additions & 6 deletions net/url_request/url_request_context.h
Original file line number Diff line number Diff line change
Expand Up @@ -134,10 +134,6 @@ class NET_EXPORT URLRequestContext final {
ProxyResolutionService* proxy_resolution_service() const {
return proxy_resolution_service_.get();
}
#if defined(STARBOARD)
void set_proxy_resolution_service(
std::unique_ptr<ProxyResolutionService> proxy_resolution_service);
#endif

ProxyDelegate* proxy_delegate() const { return proxy_delegate_.get(); }

Expand Down Expand Up @@ -261,10 +257,8 @@ class NET_EXPORT URLRequestContext final {
void set_net_log(NetLog* net_log);
void set_host_resolver(std::unique_ptr<HostResolver> host_resolver);
void set_cert_verifier(std::unique_ptr<CertVerifier> cert_verifier);
#if !defined(STARBOARD)
void set_proxy_resolution_service(
std::unique_ptr<ProxyResolutionService> proxy_resolution_service);
#endif
void set_proxy_delegate(std::unique_ptr<ProxyDelegate> proxy_delegate);
void set_ssl_config_service(std::unique_ptr<SSLConfigService> service);
void set_http_auth_handler_factory(
Expand Down

0 comments on commit bea860a

Please sign in to comment.