Merge pull request #11731 from yang-g/cpp_is_hard

Avoid use after free if the sneaky op is owned by the collection

1 files changed, 7 insertions, 2 deletions

diff --git a/include/grpc++/impl/codegen/call.h b/include/grpc++/impl/codegen/call.h
index 32bd2ad5c7..9bbe7c63f4 100644
--- a/include/grpc++/impl/codegen/call.h
+++ b/include/grpc++/impl/codegen/call.h
@@ -551,7 +551,10 @@ class CallOpClientRecvStatus {
 /// TODO(vjpai): Remove the existence of CallOpSetCollectionInterface
 /// and references to it. This code is deprecated-on-arrival and is
 /// only added for users that bypassed the code-generator.
-class CallOpSetCollectionInterface {};
+class CallOpSetCollectionInterface {
+ public:
+  virtual ~CallOpSetCollectionInterface() {}
+};
 
 /// An abstract collection of call ops, used to generate the
 /// grpc_call_op structure to pass down to the lower layers,
@@ -617,9 +620,11 @@ class CallOpSet : public CallOpSetInterface,
 
     // TODO(vjpai): Remove the reference to collection_ once the idea of
     // bypassing the code generator is forbidden. It is already deprecated
+    grpc_call* call = call_;
     collection_.reset();
 
-    g_core_codegen_interface->grpc_call_unref(call_);
+    g_core_codegen_interface->grpc_call_unref(call);
+
     return true;
   }