[M146] [remoting] Fix Use-after-Free in WebrtcVideoRendererAdapter [chromium/src : refs/branch-heads/7680]

[rubber-stamper@appspot.gserviceaccount.com (Gerrit)]

rubber-...@appspot.gserviceaccount.com voted

Bot-Commit	+1
Commit-Queue	+2

Open in Gerrit

Related details

Attention set is empty

Submit Requirements:

• Code-Owners
• Code-Review
• Lint
• Review-Enforcement

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

Gerrit-MessageType: comment

Gerrit-Project: chromium/src

Gerrit-Branch: refs/branch-heads/7680

Gerrit-Change-Id: I5adf5b2acdc1c60095892f549ac65aa9d74e7cdc

Gerrit-Change-Number: 7790120

Gerrit-PatchSet: 2

Gerrit-Owner: chrome-che...@chops-service-accounts.iam.gserviceaccount.com <chrome-che...@chops-service-accounts.iam.gserviceaccount.com>

Gerrit-Reviewer: chrome-che...@chops-service-accounts.iam.gserviceaccount.com <chrome-che...@chops-service-accounts.iam.gserviceaccount.com>

Gerrit-Reviewer: rubber-...@appspot.gserviceaccount.com <rubber-...@appspot.gserviceaccount.com>

Gerrit-CC: Joe Downing <joe...@chromium.org>

Gerrit-CC: android-bu...@system.gserviceaccount.com <android-bu...@system.gserviceaccount.com>

Gerrit-Comment-Date: Thu, 23 Apr 2026 22:03:11 +0000

Gerrit-HasComments: No

Gerrit-Has-Labels: Yes

[Chromium LUCI CQ (Gerrit)]

Chromium LUCI CQ submitted the change

Change information

Commit message:

[M146] [remoting] Fix Use-after-Free in WebrtcVideoRendererAdapter

Original change's description:
> [remoting] Fix Use-after-Free in WebrtcVideoRendererAdapter
>
> WebrtcVideoRendererAdapter registered itself as a sink on the first
> track of a MediaStream but was re-querying the stream for its first
> track during destruction. If the tracks were changed via SDP
> renegotiation, it could unregister from the wrong track, leaving a
> dangling pointer in the original track.
>
> This CL fixes the issue by caching the track the adapter is registered
> on and using that cached track for unregistration in the destructor
> and in SetMediaStream.
>
> Bug: 501722605
> Change-Id: I5adf5b2acdc1c60095892f549ac65aa9d74e7cdc
> Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7757703
> Reviewed-by: Yuwei Huang <yuw...@chromium.org>
> Commit-Queue: Joe Downing <joe...@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#1613974}

(cherry picked from commit 2fb4251778d90fe19c011a207c009a39db2e9fa1)

Bug: 503211514,501722605

Change-Id: I5adf5b2acdc1c60095892f549ac65aa9d74e7cdc

Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7790120

Commit-Queue: rubber-...@appspot.gserviceaccount.com <rubber-...@appspot.gserviceaccount.com>

Bot-Commit: rubber-...@appspot.gserviceaccount.com <rubber-...@appspot.gserviceaccount.com>

Auto-Submit: chrome-che...@chops-service-accounts.iam.gserviceaccount.com <chrome-che...@chops-service-accounts.iam.gserviceaccount.com>

Cr-Commit-Position: refs/branch-heads/7680@{#4004}

Cr-Branched-From: 76b7d80e5cda23fe6537eed26d68c92e995c7f39-refs/heads/main@{#1582197}

Files:

• M remoting/protocol/BUILD.gn
• M remoting/protocol/webrtc_video_renderer_adapter.cc
• M remoting/protocol/webrtc_video_renderer_adapter.h
• A remoting/protocol/webrtc_video_renderer_adapter_unittest.cc

Change size: M

Delta: 4 files changed, 120 insertions(+), 11 deletions(-)

Branch: refs/branch-heads/7680

Submit Requirements:

• Code-Review: Bot-Commit+1 by rubber-...@appspot.gserviceaccount.com

Open in Gerrit

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

Gerrit-MessageType: merged

Gerrit-Project: chromium/src

Gerrit-Branch: refs/branch-heads/7680

Gerrit-Change-Id: I5adf5b2acdc1c60095892f549ac65aa9d74e7cdc

Gerrit-Change-Number: 7790120

Gerrit-PatchSet: 3

Gerrit-Owner: chrome-che...@chops-service-accounts.iam.gserviceaccount.com <chrome-che...@chops-service-accounts.iam.gserviceaccount.com>

Gerrit-Reviewer: Chromium LUCI CQ <chromiu...@luci-project-accounts.iam.gserviceaccount.com>