obsproject / obsproject/obs-studio

Race condition resulting in use after free in `WidgetInfo::PathChanged`

Open
#10,423 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C
Stars
76.4k
Forks
10.2k
Avg merge
4d 23h
Merged PRs (30d)
12

Description

Operating System Info

Windows 11

Other OS

No response

OBS Studio Version

30.1.0

OBS Studio Version (Other)

No response

OBS Studio Log URL

https://obsproject.com/logs/aP4AAo30fJPRYWhb

OBS Studio Crash Log URL

https://obsproject.com/logs/Ol0L0Xm59rUj0a5b

Expected Behavior

There should not be a race condition.

Current Behavior

WidgetInfo::PathChanged is called when clicking the button to change a path, which pops up the dialog box for choosing a path. If the widgets refresh in the meantime, while the dialog box is open, the underlying path widget gets destructed underneath, meaning that when returning from the dialog box a use after free happens and OBS crashes.

Steps to Reproduce
  1. Click the button to change a path.
  2. Trigger a properties refresh in the meantime via obs_source_update_properties.
  3. The widgets now get rebuilt and the currently in use path widget gets destructed.
  4. Close the dialog box by choosing a path.
  5. The use after free happens and OBS crashes.
Anything else we should know?

One variant of the dialog box gets opened here:
https://github.com/obsproject/obs-studio/blob/69e7eb2c7de9a530bae955b00217c1caaf006d54/UI/properties-view.cpp#L1815-L1823

Use after free then triggered here:
https://github.com/obsproject/obs-studio/blob/69e7eb2c7de9a530bae955b00217c1caaf006d54/UI/properties-view.cpp#L1833-L1834

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with UI/properties-view.cpp around lines 1815-1834, reading the dialog-opening path and the WidgetInfo::PathChanged callback. Reproduce the five steps while triggering obs_source_update_properties during the dialog, then verify the path-selection workflow no longer crashes when the widgets refresh.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
desktop
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.