From d19a0a41c2d8266a9e6ab06c1e0466b027208d99 Mon Sep 17 00:00:00 2001
From: Muyao Xu <[email protected]>
Date: Fri, 29 May 2026 19:58:08 -0700
Subject: [PATCH] [cast_streaming] Fix UAF in CastMessagePortImpl

Calling `client_->OnError` in `MaybeClose` can synchronously destroy
`this`. This CL uses a WeakPtr to guard access to on_close_ to prevent
UAF.

Bug: b:517371367
Change-Id: I4f10df89ee27f00c659bda847ffdbf4e9b1b3948
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7882166
Commit-Queue: Jordan Bayles <[email protected]>
Reviewed-by: Jordan Bayles <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1638928}
---

diff --git a/components/cast_streaming/browser/cast_message_port_impl.cc b/components/cast_streaming/browser/cast_message_port_impl.cc
index 6568f23..903822d5d 100644
--- a/components/cast_streaming/browser/cast_message_port_impl.cc
+++ b/components/cast_streaming/browser/cast_message_port_impl.cc
@@ -97,6 +97,7 @@
 CastMessagePortImpl::~CastMessagePortImpl() = default;
 
 void CastMessagePortImpl::MaybeClose() {
+  base::WeakPtr<CastMessagePortImpl> weak_this = weak_factory_.GetWeakPtr();
   if (message_port_) {
     message_port_.reset();
   }
@@ -104,10 +105,10 @@
     client_->OnError(
         openscreen::Error(openscreen::Error::Code::kCastV2CastSocketError));
   }
-  if (on_close_) {
+  if (weak_this && weak_this->on_close_) {
     // |this| might be deleted as part of |on_close_| being run. Do not add any
     // code after running the closure.
-    std::move(on_close_).Run();
+    std::move(weak_this->on_close_).Run();
   }
 }
 
diff --git a/components/cast_streaming/browser/cast_message_port_impl.h b/components/cast_streaming/browser/cast_message_port_impl.h
index e70d09a..a78396eb 100644
--- a/components/cast_streaming/browser/cast_message_port_impl.h
+++ b/components/cast_streaming/browser/cast_message_port_impl.h
@@ -10,6 +10,7 @@
 
 #include "base/functional/callback.h"
 #include "base/memory/raw_ptr.h"
+#include "base/memory/weak_ptr.h"
 #include "components/cast/message_port/message_port.h"
 #include "third_party/openscreen/src/cast/common/public/message_port.h"
 
@@ -60,6 +61,8 @@
   raw_ptr<Client> client_ = nullptr;
   std::unique_ptr<cast_api_bindings::MessagePort> message_port_;
   base::OnceClosure on_close_;
+
+  base::WeakPtrFactory<CastMessagePortImpl> weak_factory_{this};
 };
 
 }  // namespace cast_streaming