Commit 86bd0448 authored by lionel.g.landwerlin's avatar lionel.g.landwerlin Committed by Commit bot

ppapi: fix crash/infinite loop in VideoEncoder

Depending on the libc used with your NaCl plugins, if the VideoEncoder
proxy receives a EncodeReply message after it has been closed, the
plugin will crash (newlib) or enter an infinite loop (glibc) because
it tries to remove the end() iterator from a std::map.

BUG=455409
TEST=run ppapi/examples/video_encode multiple times and verify the test keeps recording new videos

Review URL: https://codereview.chromium.org/1138483002

Cr-Commit-Position: refs/heads/master@{#328997}
parent 7c2f9407
......@@ -361,7 +361,12 @@ void VideoEncoderResource::OnPluginMsgEncodeReply(
PP_Resource video_frame,
const ResourceMessageReplyParams& params,
uint32_t frame_id) {
DCHECK_NE(encode_callbacks_.size(), 0U);
// We need to ensure there are still callbacks to be called before
// processing this message. We might receive a EncodeReply message
// after having sent a Close message to the renderer. In this case,
// we don't have any callback left to call.
if (encode_callbacks_.empty())
return;
encoder_last_error_ = params.result();
EncodeMap::iterator it = encode_callbacks_.find(video_frame);
......
......@@ -1136,6 +1136,14 @@ TEST_F(VideoEncoderResourceTest, Close) {
ASSERT_EQ(PP_ERROR_ABORTED, encode_cb2.result());
ASSERT_TRUE(get_bitstream_buffer_cb.called());
ASSERT_EQ(PP_ERROR_ABORTED, get_bitstream_buffer_cb.result());
// Verify that a remaining encode response from the renderer is
// discarded.
ResourceMessageCallParams params;
uint32_t frame_id;
bool force_frame;
ASSERT_TRUE(CheckEncodeMsg(&params, &frame_id, &force_frame));
SendEncodeReply(params, frame_id);
}
}
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment