adb: fix use after free of atransport.
libadbd_auth might report authentication success for a transport that's
already been destroyed. Fix this by storing a weak pointer to the
atransport that gets cleared upon destruction instead of a raw pointer.
Bug: http://b/144704376
Test: ./test_adb.py
Test: ./test_device.py
Change-Id: Idffe027381e6b2e37f06aa0166e97cafc98eaf3b
diff --git a/adb/transport.h b/adb/transport.h
index ea77117..7a41601 100644
--- a/adb/transport.h
+++ b/adb/transport.h
@@ -38,6 +38,7 @@
#include "adb.h"
#include "adb_unique_fd.h"
+#include "types.h"
#include "usb.h"
typedef std::unordered_set<std::string> FeatureSet;
@@ -223,7 +224,7 @@
Abort,
};
-class atransport {
+class atransport : public enable_weak_from_this<atransport> {
public:
// TODO(danalbert): We expose waaaaaaay too much stuff because this was
// historically just a struct, but making the whole thing a more idiomatic
@@ -246,7 +247,7 @@
}
atransport(ConnectionState state = kCsOffline)
: atransport([](atransport*) { return ReconnectResult::Abort; }, state) {}
- virtual ~atransport();
+ ~atransport();
int Write(apacket* p);
void Reset();