Commit e48ff40b authored by David Benjamin's avatar David Benjamin Committed by Commit Bot

Fix a string lifetime bug in perfetto support code

This is a speculative fix for the test failures in
https://crbug.com/923166#c40 based on the stack in the logcat and code
inspection. AndroidSystemProducer stores a raw const char* pointer
passed in from many layers up the stack.

In particular, the SetSystemProducerSocketAndChecksAsync function used
in tests passes in producer_string.c_str() where producer_string is a
std::string that was bound into a callback somewhere. This is a UAF and
I suspect it is what's tripping the libc++ debugging assertion.

Bug: 923166
Change-Id: Id9153009c34ef942a2d9a4b21c760c0394258f54
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1924235
Auto-Submit: David Benjamin <davidben@chromium.org>
Reviewed-by: default avatarStephen Nusko <nuskos@chromium.org>
Reviewed-by: default avatarEric Seckler <eseckler@chromium.org>
Commit-Queue: Eric Seckler <eseckler@chromium.org>
Cr-Commit-Position: refs/heads/master@{#719870}
parent 436691dc
...@@ -405,7 +405,7 @@ void AndroidSystemProducer::ActivateTriggers( ...@@ -405,7 +405,7 @@ void AndroidSystemProducer::ActivateTriggers(
void AndroidSystemProducer::ConnectSocket() { void AndroidSystemProducer::ConnectSocket() {
state_ = State::kConnecting; state_ = State::kConnecting;
service_ = perfetto::ProducerIPCClient::Connect( service_ = perfetto::ProducerIPCClient::Connect(
socket_name_, this, socket_name_.c_str(), this,
base::StrCat( base::StrCat(
{mojom::kPerfettoProducerNamePrefix, {mojom::kPerfettoProducerNamePrefix,
base::NumberToString( base::NumberToString(
......
...@@ -137,7 +137,7 @@ class COMPONENT_EXPORT(TRACING_CPP) AndroidSystemProducer ...@@ -137,7 +137,7 @@ class COMPONENT_EXPORT(TRACING_CPP) AndroidSystemProducer
// later. // later.
void DelayedReconnect(); void DelayedReconnect();
const char* socket_name_; std::string socket_name_;
uint32_t connection_backoff_ms_; uint32_t connection_backoff_ms_;
uint64_t data_sources_tracing_ = 0; uint64_t data_sources_tracing_ = 0;
bool disallow_pre_android_pie = true; bool disallow_pre_android_pie = true;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment