ソースを参照

libobs: Fix possible use-after-free of obs_scene_t

When creating a group, a newly allocated group `sub_scene` is released
just after calling `obs_scene_add_internal`.
If another thread released the scene-item, which is the sub_scene,
use-after-free might happen.
Norihiro Kamae 2 年 前
コミット
434bdc1768
2 ファイル変更5 行追加4 行削除
  1. 1 1
      UI/window-basic-transform.cpp
  2. 4 3
      libobs/obs-scene.c

+ 1 - 1
UI/window-basic-transform.cpp

@@ -354,6 +354,6 @@ void OBSBasicTransform::OnSceneChanged(QListWidgetItem *current,
 	if (!current)
 		return;
 
-	obs_scene_t *scene = GetOBSRef<OBSScene>(current);
+	OBSScene scene = GetOBSRef<OBSScene>(current);
 	this->SetScene(scene);
 }

+ 4 - 3
libobs/obs-scene.c

@@ -3301,10 +3301,10 @@ obs_sceneitem_t *obs_scene_insert_group(obs_scene_t *scene, const char *name,
 	obs_sceneitem_t *item =
 		obs_scene_add_internal(scene, sub_scene->source, last_item);
 
-	obs_scene_release(sub_scene);
-
-	if (!items || !count)
+	if (!items || !count) {
+		obs_scene_release(sub_scene);
 		return item;
+	}
 
 	/* ------------------------- */
 
@@ -3345,6 +3345,7 @@ obs_sceneitem_t *obs_scene_insert_group(obs_scene_t *scene, const char *name,
 
 	/* ------------------------- */
 
+	obs_scene_release(sub_scene);
 	return item;
 }