From 12062598a142acbd686053d3e5dbd4e0fb1e9278 Mon Sep 17 00:00:00 2001
From: Jordan Bayles <jophba@chromium.org>
Date: Fri, 29 May 2026 16:56:20 -0700
Subject: [PATCH] Fix cross-thread UAF in MediaVideoEncoderWrapper

This CL addresses a Use-After-Free vulnerability when hardware encoding is enabled in MediaVideoEncoderWrapper by ensuring the callback waiting for a Flush operation is bound to a WeakPtr. This prevents a dangling pointer access to the VideoEncoder instance if the wrapper is destroyed while a flush is pending.

Bug: 513240099
Change-Id: Iff43d6e7a31d135c74247d53b4aea88c2e840d05
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7855174
Commit-Queue: Jordan Bayles <jophba@chromium.org>
Reviewed-by: Eugene Zemtsov <eugene@chromium.org>
Commit-Queue: Eugene Zemtsov <eugene@chromium.org>
Auto-Submit: Jordan Bayles <jophba@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1638826}
---

diff --git a/media/cast/encoding/media_video_encoder_wrapper.cc b/media/cast/encoding/media_video_encoder_wrapper.cc
index 388e9ee6..9a011cc 100644
--- a/media/cast/encoding/media_video_encoder_wrapper.cc
+++ b/media/cast/encoding/media_video_encoder_wrapper.cc
@@ -493,21 +493,23 @@
   CHECK(cast_environment_->CurrentlyOn(CastEnvironment::ThreadId::kMain));
   num_pending_updates_++;
 
-  // Once the Flush() call is complete, we can safely call ChangeOptions() on
-  // the encoder.
-  auto flush_done_callback = base::BindOnce(
-      &CallChangeOptions,
-      // NOTE: Here and below, raw reference is safe because the encoder is
-      // deleted in a task posted to the video thread.
-      std::ref(*encoder_), options_,
-      CreateCallback(&MediaVideoEncoderWrapper::OnEncodedFrame),
-      CreateCallback(&MediaVideoEncoderWrapper::OnOptionsUpdated));
-
-  // Call Flush on the correct thread.
+  auto flush_done_callback = CreateCallback(
+      &MediaVideoEncoderWrapper::OnFlushDoneForOptionsUpdate, options_);
   CallEncoderOnCorrectThread(base::BindOnce(&CallFlush, std::ref(*encoder_),
                                             std::move(flush_done_callback)));
 }
 
+void MediaVideoEncoderWrapper::OnFlushDoneForOptionsUpdate(
+    media::VideoEncoder::Options options,
+    EncoderStatus status) {
+  CHECK(cast_environment_->CurrentlyOn(CastEnvironment::ThreadId::kMain));
+  CallEncoderOnCorrectThread(base::BindOnce(
+      &CallChangeOptions, std::ref(*encoder_), std::move(options),
+      CreateCallback(&MediaVideoEncoderWrapper::OnEncodedFrame),
+      CreateCallback(&MediaVideoEncoderWrapper::OnOptionsUpdated),
+      std::move(status)));
+}
+
 void MediaVideoEncoderWrapper::CallEncoderOnCorrectThread(
     base::OnceClosure closure) {
   CHECK(cast_environment_->CurrentlyOn(CastEnvironment::ThreadId::kMain));
diff --git a/media/cast/encoding/media_video_encoder_wrapper.h b/media/cast/encoding/media_video_encoder_wrapper.h
index 192679a..2ae8c19 100644
--- a/media/cast/encoding/media_video_encoder_wrapper.h
+++ b/media/cast/encoding/media_video_encoder_wrapper.h
@@ -121,6 +121,8 @@
   // Posts a task to update the encoder options, such as whether a key frame
   // is requested.
   void UpdateEncoderOptions();
+  void OnFlushDoneForOptionsUpdate(media::VideoEncoder::Options options,
+                                   EncoderStatus status);
   void OnOptionsUpdated(EncoderStatus status);
 
   // We currently manage the threads used for interacting with the encoder