quic: fix UAF in Application::OnTimeout()

jasnell · aduh95 · commit fd00e0acb080 · 2026-05-23T00:05:41.000+02:00
Signed-off-by: James M Snell <jasnell@gmail.com> Assisted-by: Opencode:Opus 4.6 PR-URL: #63267 Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
diff --git a/src/quic/application.cc b/src/quic/application.cc
@@ -369,12 +369,14 @@ void Session::Application::SendPendingData() {
     if (closed) return;
     // Flush any remaining accumulated packets before updating stats.
     flush_batch();
-    auto& s = session();
-    if (!s.is_destroyed()) [[likely]] {
-      s.UpdatePacketTxTime();
-      s.UpdateTimer();
-      s.UpdateDataStats();
-    }
+    if (session().is_destroyed()) [[unlikely]] return;
+
+    // Get a strong pointer to protect against potential destruction during
+    // updating the time and data stats.
+    BaseObjectPtr<Session> s(session_);
+    s->UpdatePacketTxTime();
+    s->UpdateTimer();
+    s->UpdateDataStats();
   });
 
   // The maximum size of packet to create.
diff --git a/src/quic/session.cc b/src/quic/session.cc
@@ -3018,6 +3018,15 @@ void Session::SendConnectionClose() {
 void Session::OnTimeout() {
   if (is_destroyed()) return;
   if (!impl_->application_) return;
+  // Hold a strong reference to prevent the Session from being freed during
+  // re-entrant calls. SendPendingData's scope guard calls UpdateTimer(),
+  // which can synchronously re-enter OnTimeout() when the timer has already
+  // expired. That re-entrant path can reach FinishClose &rarr; EmitClose &rarr;
+  // Destroy &rarr; impl_.reset() &rarr; ~Impl &rarr; RemoveSession(), dropping the last
+  // BaseObjectPtr from the endpoint map and freeing the Session. Without
+  // this guard, the outer OnTimeout / SendPendingData frames would operate
+  // on a freed object.
+  BaseObjectPtr<Session> ref(this);
   HandleScope scope(env()->isolate());
   int ret;
   {
