commit d49e9a4d21e443af2c37eb33c614eb5b23b7dec7
author David Garcia Quintas <dgq@google.com> Thu Aug 31 09:05:02 2017 -0700
committer David Garcia Quintas <dgq@google.com> Thu Aug 31 09:16:34 2017 -0700
tree ff31e1493e00914016687f6d3984c5c1d2db16b5
parent 0c21e334c75b4ced6f242f5639daa58899569863

Fake resolver: Fix use-after-free

src/core/ext/filters/client_channel/resolver/fake/fake_resolver.c

diff --git a/src/core/ext/filters/client_channel/resolver/fake/fake_resolver.c b/src/core/ext/filters/client_channel/resolver/fake/fake_resolver.c
index 56ed437..302b73e 100644
--- a/src/core/ext/filters/client_channel/resolver/fake/fake_resolver.c
+++ b/src/core/ext/filters/client_channel/resolver/fake/fake_resolver.c
@@ -125,7 +125,6 @@
 
 struct grpc_fake_resolver_response_generator {
   fake_resolver* resolver;  // Set by the fake_resolver constructor to itself.
-  grpc_channel_args* next_response;
   gpr_refcount refcount;
 };
 
@@ -151,19 +150,25 @@
   }
 }
 
+typedef struct set_response_cb_arg {
+  grpc_fake_resolver_response_generator* generator;
+  grpc_channel_args* next_response;
+} set_response_cb_arg;
+
 static void set_response_cb(grpc_exec_ctx* exec_ctx, void* arg,
                             grpc_error* error) {
-  grpc_fake_resolver_response_generator* generator =
-      (grpc_fake_resolver_response_generator*)arg;
+  set_response_cb_arg* cb_arg = arg;
+  grpc_fake_resolver_response_generator* generator = cb_arg->generator;
   fake_resolver* r = generator->resolver;
   if (r->next_results != NULL) {
     grpc_channel_args_destroy(exec_ctx, r->next_results);
   }
-  r->next_results = generator->next_response;
+  r->next_results = cb_arg->next_response;
   if (r->results_upon_error != NULL) {
     grpc_channel_args_destroy(exec_ctx, r->results_upon_error);
   }
-  r->results_upon_error = grpc_channel_args_copy(generator->next_response);
+  r->results_upon_error = grpc_channel_args_copy(cb_arg->next_response);
+  gpr_free(cb_arg);
   fake_resolver_maybe_finish_next_locked(exec_ctx, r);
 }
 
@@ -171,9 +176,11 @@
     grpc_exec_ctx* exec_ctx, grpc_fake_resolver_response_generator* generator,
     grpc_channel_args* next_response) {
   GPR_ASSERT(generator->resolver != NULL);
-  generator->next_response = grpc_channel_args_copy(next_response);
+  set_response_cb_arg* cb_arg = gpr_zalloc(sizeof(*cb_arg));
+  cb_arg->generator = generator;
+  cb_arg->next_response = grpc_channel_args_copy(next_response);
   GRPC_CLOSURE_SCHED(
-      exec_ctx, GRPC_CLOSURE_CREATE(set_response_cb, generator,
+      exec_ctx, GRPC_CLOSURE_CREATE(set_response_cb, cb_arg,
                                     grpc_combiner_scheduler(
                                         generator->resolver->base.combiner)),
       GRPC_ERROR_NONE);