From 24c6dd901536f385c8085ef168e37b05af7a01f7 Mon Sep 17 00:00:00 2001
From: Francis Tsui <ftsui@google.com>
Date: Mon, 11 May 2026 10:07:23 -0700
Subject: [PATCH] Fix UAF in transfer_manager.cc

PiperOrigin-RevId: 913757006
---
 sharing/nearby_connections_manager_impl.cc | 22 +++++++++++++++++++---
 sharing/nearby_connections_manager_impl.h  |  3 +++
 2 files changed, 22 insertions(+), 3 deletions(-)

diff --git a/sharing/nearby_connections_manager_impl.cc b/sharing/nearby_connections_manager_impl.cc
index 8339895f..0b57e8c0 100644
--- a/sharing/nearby_connections_manager_impl.cc
+++ b/sharing/nearby_connections_manager_impl.cc
@@ -334,6 +334,12 @@ void NearbyConnectionsManagerImpl::StopDiscovery() {
       });
 }
 
+void NearbyConnectionsManagerImpl::RemoveTransferManagerOnCallbackThread(
+    std::unique_ptr<TransferManager> transfer_manager) const {
+  connections_callback_task_runner_->PostTask(
+      [transfer_manager = std::move(transfer_manager)]() {});
+}
+
 void NearbyConnectionsManagerImpl::Connect(
     std::vector<uint8_t> endpoint_info, absl::string_view endpoint_id,
     std::optional<std::vector<uint8_t>> bluetooth_mac_address,
@@ -416,7 +422,10 @@ void NearbyConnectionsManagerImpl::Connect(
       [this, endpoint_id = std::string(endpoint_id)](ConnectionsStatus status) {
         MutexLock lock(&mutex_);
         if (status != ConnectionsStatus::kSuccess) {
-          transfer_managers_.erase(endpoint_id);
+          auto node = transfer_managers_.extract(endpoint_id);
+          if (!node.empty()) {
+            RemoveTransferManagerOnCallbackThread(std::move(node.mapped()));
+          }
         }
         OnConnectionRequested(endpoint_id, status);
       });
@@ -740,7 +749,10 @@ void NearbyConnectionsManagerImpl::OnDisconnected(
   const auto& transfer_manager_it = transfer_managers_.find(endpoint_id);
   if (transfer_manager_it != transfer_managers_.end()) {
     transfer_manager_it->second->CancelTransfer();
-    transfer_managers_.erase(transfer_manager_it);
+    auto node = transfer_managers_.extract(transfer_manager_it);
+    if (!node.empty()) {
+      RemoveTransferManagerOnCallbackThread(std::move(node.mapped()));
+    }
   }
 
   Status connection_layer_status = Status::kUnknown;
@@ -907,7 +919,11 @@ void NearbyConnectionsManagerImpl::Reset() {
   for (auto& transfer_manager : transfer_managers_) {
     transfer_manager.second->CancelTransfer();
   }
-  transfer_managers_.clear();
+  absl::flat_hash_map<std::string, std::unique_ptr<TransferManager>>
+      transfer_managers;
+  transfer_managers.swap(transfer_managers_);
+  connections_callback_task_runner_->PostTask(
+      [transfer_managers = std::move(transfer_managers)]() {});
 
   for (auto& entry : pending_outgoing_connections_)
     std::move(entry.second)(entry.first, /*connection=*/nullptr,
diff --git a/sharing/nearby_connections_manager_impl.h b/sharing/nearby_connections_manager_impl.h
index bf9ce1e8..174f83f8 100644
--- a/sharing/nearby_connections_manager_impl.h
+++ b/sharing/nearby_connections_manager_impl.h
@@ -143,6 +143,9 @@ class NearbyConnectionsManagerImpl : public NearbyConnectionsManager {
   void SendWithoutDelay(absl::string_view endpoint_id,
                         std::unique_ptr<Payload> payload);
 
+  void RemoveTransferManagerOnCallbackThread(
+      std::unique_ptr<TransferManager> transfer_manager) const;
+
   nearby::TaskRunner* const connections_callback_task_runner_;
   Context* const context_;
   nearby::ConnectivityManager& connectivity_manager_;