Skip to content

webrtc: Fix possible use-after-free of GstWebRTCICETransport

Johan Sternerup requested to merge johast/gstreamer:weak_ice_transport into main

Because of the asynchronous resolving of mDNS ICE candidates it is possible that GstWebRTCICE outlives webrtcbin. This in turn prolongs the lifetime of the GstWebRTCNiceStream objects via refs in nice_stream_map. Thus the GstWebRTCICETransport objects held in GstWebRTCNiceStream may be invalid at the time they are accessed by the _on_candidate_gathering_done() callback since GstWebRTCNiceStream doesn't take a reference to them. Doing so would create a circular reference, so instead this commit introduces weak references to the transport objects and then we can check if the objects are valid before accessing them.

Merge request reports