Possible Use-After-Free in the platform cert validator.

envoyproxy / envoy-mobile

Client HTTP and networking library based on the Envoy project for iOS, Android, and more.

https://envoymobile.io

Apache License 2.0

557 stars 84 forks source link

Possible Use-After-Free in the platform cert validator. #2691

Closed RyanTheOptimist closed 1 year ago

RyanTheOptimist commented 1 year ago

PlatformBridgeCertValidator uses and absl::flat_hash_set to store pending certificate verifications. These are stored as PendingVerification, directly in the flat_hash_set and the validation thread holds a pointer to the PendingVerification. However, flat_hash_set does not ensure pointer stability which means it is possible for this pointer to become invalid.