Use after free of SessionHandle with SecureSession

[kpschoedel]

Problem

(revised description in light of initial investigation)

Using a heap ObjectPool for SecureSessionTable::mEntries lets ASAN tracking catch use-after-free:

1. SessionHandle uses a ReferenceCountedHandle, which calls Retain() and Release() on the Session — but SecureSession inherits the Session default implementations, which are empty, so there is in fact no reference counting.

2. ~SecureSession() (called e.g. from ExpireInactiveSessions) does call NotifySessionReleased(), but SessionHandle does not register for notification, so its reference becomes stale.

Proposed Solution

Either actually reference counting or using notification to invalidate SessionHandles would solve the use-after-free, but have different implications for SecureSession lifetime.

Either way, SecureSessionTable::mEntries should be converted to a (build-configurable) ObjectPool so that ASAN can catch regressions.

[bzbarsky-apple]

@kghost @mrjerryjohns is this still an issue?

[woody-apple]

Issue Scrub: Assigning to @kpschoedel to confirm if this is still happening.

[kpschoedel]

This case can't be happening any more; the code is now using ObjectPool, so ASAN would catch any use-after-free.