Fix use after free bug in API fuzzer (#28230)

3 years ago · bb02562307
parent 13c343d5e0
commit bb02562307
2 changed files with 2089 additions and 1 deletions
--- a/test/core/end2end/fuzzers/api_fuzzer_corpus/testcase-5097648256581632
+++ b/test/core/end2end/fuzzers/api_fuzzer_corpus/testcase-5097648256581632
--- a/test/core/util/passthru_endpoint.cc
+++ b/test/core/util/passthru_endpoint.cc
@ -81,7 +81,9 @@ static void do_pending_read_op_locked(half* m, grpc_error_handle error) {
    grpc_core::ExecCtx::Run(
        DEBUG_LOCATION, m->pending_read_op.cb,
        GRPC_ERROR_CREATE_FROM_STATIC_STRING("Already shutdown"));
-    grpc_slice_buffer_reset_and_unref(&m->read_buffer);
+    // Move any pending data into pending_read_op.slices so that it may be
+    // free'ed by the executing callback.
+    grpc_slice_buffer_move_into(&m->read_buffer, m->pending_read_op.slices);
    m->pending_read_op.is_armed = false;
    return;
  }