Fix Use-After-Free in ActionContext destructor. Store temporary task name strings in an explicit std::array to ensure their lifetimes span the entire cancellation loop, avoiding dangling absl::string_view instances when calling CancelCall. Follow-up fix for cl/968097005. PiperOrigin-RevId: 974074293 Change-Id: Idc5534990dedc3fd98aff0184fcf265dd7c15401
diff --git a/action_context.cc b/action_context.cc index 121d01f..2a70f23 100644 --- a/action_context.cc +++ b/action_context.cc
@@ -1,6 +1,7 @@ #include "action_context.h" #include <algorithm> +#include <array> #include <functional> #include <iostream> #include <memory> @@ -173,9 +174,10 @@ ActionContext::~ActionContext() { // Always try to cancel. This will fail if the action is already finished or // has not started yet, which is fine. - for (absl::string_view task_name : - {init_task_name(), execution_task_name(), response_task_name(), - final_state_task_name()}) { + const std::array<std::string, 4> tasks = { + init_task_name(), execution_task_name(), response_task_name(), + final_state_task_name()}; + for (absl::string_view task_name : tasks) { absl::Status cancel_status = DaemonContext::Get().scheduler().CancelCall(task_name); if (!cancel_status.ok() && !absl::IsNotFound(cancel_status)) {
diff --git a/piper_cl.txt b/piper_cl.txt index 70bda02..5cd05b6 100644 --- a/piper_cl.txt +++ b/piper_cl.txt
@@ -1 +1 @@ -972340118 +974074293