mirror/obs-studio
0
0
Fork 0
mirror of https://github.com/obsproject/obs-studio.git synced 2024-09-20 04:42:18 +02:00
Code

libobs: Fix possible use-after-free of obs_scene_t

Browse Source 
When creating a group, a newly allocated group `sub_scene` is released
just after calling `obs_scene_add_internal`.
If another thread released the scene-item, which is the sub_scene,
use-after-free might happen.
This commit is contained in:
Norihiro Kamae 2023-03-18 14:05:04 +09:00 committed by Jim
parent 0959a22de3
commit 434bdc1768
2 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
UI/window-basic-transform.cpp
View File

@ -354,6 +354,6 @@ void OBSBasicTransform::OnSceneChanged(QListWidgetItem *current,
if (!current)
return;
obs_scene_t *scene = GetOBSRef<OBSScene>(current);
OBSScene scene = GetOBSRef<OBSScene>(current);
this->SetScene(scene);
}

7
libobs/obs-scene.c
View File

@ -3301,10 +3301,10 @@ obs_sceneitem_t *obs_scene_insert_group(obs_scene_t *scene, const char *name,
obs_sceneitem_t *item =
obs_scene_add_internal(scene, sub_scene->source, last_item);
obs_scene_release(sub_scene);
if (!items || !count)
if (!items || !count) {
obs_scene_release(sub_scene);
return item;
}
/* ------------------------- */
@ -3345,6 +3345,7 @@ obs_sceneitem_t *obs_scene_insert_group(obs_scene_t *scene, const char *name,
/* ------------------------- */
obs_scene_release(sub_scene);
return item;
}