Fix use-after-free in DNS64 discovery thread
DNS64 discovery thread is detached from binder requesting thread. But the discovery thread references resources not belongs to itself, which can be destroyed in dnsresolver destruction. Holds a strong pointer of Dns64Configuration in DNS64 discovery thread so that the instance of Dns64Configuration will keep until the DNS64 thread is force terminated. Ignore-AOSP-First: Fix security vulnerability Bug: 278303745 Test: m, fuzzing Fuzzing: mma resolv_service_fuzzer && adb sync data && adb shell /data/fuzz/arm64/resolv_service_fuzzer/resolv_service_fuzzer (cherry picked from commit 25411558) (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:cad5a8c884345689f5f2a1b6679c89524b066d15) Merged-In: Id74ea4e6f54a00805d3cc8a9d7e15e58a473b7d3 Change-Id: Id74ea4e6f54a00805d3cc8a9d7e15e58a473b7d3
Loading
Please register or sign in to comment