From aa8f28d082bfb33b9e6464aee329678510772d7a Mon Sep 17 00:00:00 2001
From: Ilya Nikolaevskiy <ilnik@webrtc.org>
Date: Fri, 28 Oct 2022 11:07:45 +0200
Subject: [PATCH] Fix UAF in MultiplexDecoderFactory::GetSupportedFormats
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bug: chromium:1378571
Change-Id: I01f105a2f2820af440cf64c654b321f34186d7e0
Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/280961
Commit-Queue: Ilya Nikolaevskiy <ilnik@webrtc.org>
Auto-Submit: Ilya Nikolaevskiy <ilnik@webrtc.org>
Reviewed-by: Erik Språng <sprang@webrtc.org>
Cr-Commit-Position: refs/heads/main@{#38493}
---
 media/engine/multiplex_codec_factory.cc | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/media/engine/multiplex_codec_factory.cc b/media/engine/multiplex_codec_factory.cc
index fb296811db..660c3594bc 100644
--- a/media/engine/multiplex_codec_factory.cc
+++ b/media/engine/multiplex_codec_factory.cc
@@ -82,16 +82,17 @@ MultiplexDecoderFactory::MultiplexDecoderFactory(
 std::vector<SdpVideoFormat> MultiplexDecoderFactory::GetSupportedFormats()
     const {
   std::vector<SdpVideoFormat> formats = factory_->GetSupportedFormats();
+  std::vector<SdpVideoFormat> augmented_formats = formats;
   for (const auto& format : formats) {
     if (absl::EqualsIgnoreCase(format.name, kMultiplexAssociatedCodecName)) {
       SdpVideoFormat multiplex_format = format;
       multiplex_format.parameters[cricket::kCodecParamAssociatedCodecName] =
           format.name;
       multiplex_format.name = cricket::kMultiplexCodecName;
-      formats.push_back(multiplex_format);
+      augmented_formats.push_back(multiplex_format);
     }
   }
-  return formats;
+  return augmented_formats;
 }
 
 std::unique_ptr<VideoDecoder> MultiplexDecoderFactory::CreateVideoDecoder(