From ecf7dbfe8178b0a10883fe7e34d386425a82e25c Mon Sep 17 00:00:00 2001
From: Simeon Anfinrud <sanfin@chromium.org>
Date: Wed, 06 May 2026 13:23:06 -0700
Subject: [PATCH] [chromecast] Fix Potential Use-After-Free in Chromecast BLE RemoteDeviceImpl

Check if service exists and remove its characteristics before replacing it to prevent UAF.

Bug: 499189601
Test: Compiled and passed unit tests.
Change-Id: Ifa363813a67f2541376afecdcad497103365be6a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7765501
Commit-Queue: Simeon Anfinrud <sanfin@chromium.org>
Reviewed-by: Yuchen Liu <yucliu@chromium.org>
Reviewed-by: Sandeep Vijayasekar <sandv@google.com>
Auto-Submit: Simeon Anfinrud <sanfin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1626411}
---

diff --git a/chromecast/device/bluetooth/le/remote_device_impl.cc b/chromecast/device/bluetooth/le/remote_device_impl.cc
index caa8be1..570c7cee 100644
--- a/chromecast/device/bluetooth/le/remote_device_impl.cc
+++ b/chromecast/device/bluetooth/le/remote_device_impl.cc
@@ -499,6 +499,12 @@
     const std::vector<bluetooth_v2_shlib::Gatt::Service>& services) {
   DCHECK(io_task_runner_->BelongsToCurrentThread());
   for (const auto& service : services) {
+    auto it = uuid_to_service_.find(service.uuid);
+    if (it != uuid_to_service_.end()) {
+      for (auto& characteristic : it->second->GetCharacteristics()) {
+        handle_to_characteristic_.erase(characteristic->handle());
+      }
+    }
     uuid_to_service_[service.uuid] = new RemoteServiceImpl(
         this, gatt_client_manager_, service, io_task_runner_);
   }