mltframework / mltframework/mlt
Producer creation using xml is not thread-safe and can lead to double free
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 1.9k
- Forks
- 387
- Avg merge
- 17h 28m
- Merged PRs (30d)
- 8
Description
This happens because the xml-producer has side-effects on the profile. Hence, if several clips are concurrently created using the same profile, nasty things can happen.
One such example is producer_xml.c:348. The profile description is freed then reallocated on the next line, through a strdup. If two threads execute this line at the same time, a double-free occurs.
Regardless of that though, concurrent writes can lead to unexpected behaviour.
I couldn't produce a minimal code that hits a double free, but it does happen in prod.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at producer_xml.c:348 and trace how the XML producer updates the shared profile while clips are created concurrently. Investigate the profile description free/reallocation and other concurrent writes, then validate that concurrent producer creation no longer causes double-free or unexpected profile behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100