obsproject / obsproject/obs-studio
Race condition resulting in use after free in `WidgetInfo::PathChanged`
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 76.4k
- Forks
- 10.2k
- Avg merge
- 4d 23h
- Merged PRs (30d)
- 12
Description
Operating System Info
Windows 11
Other OS
No response
OBS Studio Version
30.1.0
OBS Studio Version (Other)
No response
OBS Studio Log URL
https://obsproject.com/logs/aP4AAo30fJPRYWhb
OBS Studio Crash Log URL
https://obsproject.com/logs/Ol0L0Xm59rUj0a5b
Expected Behavior
There should not be a race condition.
Current Behavior
WidgetInfo::PathChanged is called when clicking the button to change a path, which pops up the dialog box for choosing a path. If the widgets refresh in the meantime, while the dialog box is open, the underlying path widget gets destructed underneath, meaning that when returning from the dialog box a use after free happens and OBS crashes.
Steps to Reproduce
- Click the button to change a path.
- Trigger a properties refresh in the meantime via
obs_source_update_properties. - The widgets now get rebuilt and the currently in use path widget gets destructed.
- Close the dialog box by choosing a path.
- The use after free happens and OBS crashes.
Anything else we should know?
One variant of the dialog box gets opened here:
https://github.com/obsproject/obs-studio/blob/69e7eb2c7de9a530bae955b00217c1caaf006d54/UI/properties-view.cpp#L1815-L1823
Use after free then triggered here:
https://github.com/obsproject/obs-studio/blob/69e7eb2c7de9a530bae955b00217c1caaf006d54/UI/properties-view.cpp#L1833-L1834
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with UI/properties-view.cpp around lines 1815-1834, reading the dialog-opening path and the WidgetInfo::PathChanged callback. Reproduce the five steps while triggering obs_source_update_properties during the dialog, then verify the path-selection workflow no longer crashes when the widgets refresh.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- desktop
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 38/100