Possible race in local_participant

Author: alan-george-lk

include/livekit/local_participant.h

@@ -246,6 +246,14 @@ class LIVEKIT_API LocalParticipant : public Participant {
   /// prune expired @c weak_ptr entries.
   mutable TrackMap published_tracks_by_sid_;
 
+  /// Guards @ref published_tracks_by_sid_. The map is written from the
+  /// application thread (@ref publishTrack / @ref unpublishTrack) and both read
+  /// and pruned from the FFI callback thread (@ref trackPublications /
+  /// @ref findTrackPublication, reached via Room::onEvent). Without this lock
+  /// those concurrent accesses race and free map nodes out from under each
+  /// other (heap-use-after-free). Leaf lock: no other lock is taken while held.
+  mutable std::mutex published_tracks_mutex_;
+
   std::unordered_map<std::string, RpcHandler> rpc_handlers_;
 
   // Shared state for RPC invocation tracking. Using shared_ptr so the state

src/local_participant.cpp

@@ -197,7 +197,10 @@ void LocalParticipant::publishTrack(const std::shared_ptr<Track>& track, const T
   auto publication = std::make_shared<LocalTrackPublication>(owned_pub);
 
   const std::string sid = publication->sid();
-  published_tracks_by_sid_[sid] = std::weak_ptr<Track>(track);
+  {
+    const std::scoped_lock<std::mutex> lock(published_tracks_mutex_);
+    published_tracks_by_sid_[sid] = std::weak_ptr<Track>(track);
+  }
 
   track->setPublication(publication);
 }
@@ -237,6 +240,7 @@ void LocalParticipant::unpublishTrack(const std::string& track_sid) {
 
   fut.get();
 
+  const std::scoped_lock<std::mutex> lock(published_tracks_mutex_);
   if (auto it = published_tracks_by_sid_.find(track_sid); it != published_tracks_by_sid_.end()) {
     if (auto t = it->second.lock()) {
       t->setPublication(nullptr);
@@ -247,6 +251,7 @@ void LocalParticipant::unpublishTrack(const std::string& track_sid) {
 
 LocalParticipant::PublicationMap LocalParticipant::trackPublications() const {
   PublicationMap out;
+  const std::scoped_lock<std::mutex> lock(published_tracks_mutex_);
   for (auto it = published_tracks_by_sid_.begin(); it != published_tracks_by_sid_.end();) {
     auto t = it->second.lock();
     if (!t) {
@@ -443,6 +448,7 @@ void LocalParticipant::handleRpcMethodInvocation(uint64_t invocation_id, const s
 }
 
 std::shared_ptr<TrackPublication> LocalParticipant::findTrackPublication(const std::string& sid) const {
+  const std::scoped_lock<std::mutex> lock(published_tracks_mutex_);
   auto it = published_tracks_by_sid_.find(sid);
   if (it == published_tracks_by_sid_.end()) {
     return nullptr;