commit b5706aaa0cdbc554cd5e1e068ce2b1438a5751be
author martinduke <martinduke@google.com> Wed Jan 08 10:36:28 2025 -0800
committer Copybara-Service <copybara-worker@google.com> Wed Jan 08 10:37:13 2025 -0800
tree 20f1b092f74403de3da4ee8d50063ed51f422f8d
parent 627de3839f0f1726912bee8a54afd91d5b74bf77

Fix use-after-free in MoQ Chat Server.

When the server is tearing down, it triggers session teardown logic that calls server functions. Those calls should exit early.

Repro now passes.

PiperOrigin-RevId: 713340105

quiche/quic/moqt/tools/chat_server.cc

diff --git a/quiche/quic/moqt/tools/chat_server.cc b/quiche/quic/moqt/tools/chat_server.cc
index 871390b..e6a03f9 100644
--- a/quiche/quic/moqt/tools/chat_server.cc
+++ b/quiche/quic/moqt/tools/chat_server.cc
@@ -77,7 +77,6 @@
       [this](absl::string_view error_message) {
         std::cout << "Session terminated, reason = " << error_message << "\n";
         session_ = nullptr;
-        server_->DeleteSession(it_);
         if (track_name_.has_value()) {
           server_->DeleteUser(*track_name_);
         }
@@ -205,6 +204,9 @@
 }
 
 void ChatServer::DeleteUser(FullTrackName track_name) {
+  if (!is_running_) {
+    return;
+  }
   // RemoveAllSubscriptions() sends a SUBSCRIBE_DONE for each.
   user_queues_[track_name]->RemoveAllSubscriptions();
   user_queues_.erase(track_name);