From 434bdc17684f6da7f37e85f61bf1795c26d7a5cb Mon Sep 17 00:00:00 2001 From: Norihiro Kamae Date: Sat, 18 Mar 2023 14:05:04 +0900 Subject: [PATCH] libobs: Fix possible use-after-free of obs_scene_t When creating a group, a newly allocated group `sub_scene` is released just after calling `obs_scene_add_internal`. If another thread released the scene-item, which is the sub_scene, use-after-free might happen. --- UI/window-basic-transform.cpp | 2 +- libobs/obs-scene.c | 7 ++++--- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/UI/window-basic-transform.cpp b/UI/window-basic-transform.cpp index a66c16ab4..830b9d012 100644 --- a/UI/window-basic-transform.cpp +++ b/UI/window-basic-transform.cpp @@ -354,6 +354,6 @@ void OBSBasicTransform::OnSceneChanged(QListWidgetItem *current, if (!current) return; - obs_scene_t *scene = GetOBSRef(current); + OBSScene scene = GetOBSRef(current); this->SetScene(scene); } diff --git a/libobs/obs-scene.c b/libobs/obs-scene.c index 9b4086082..093519354 100644 --- a/libobs/obs-scene.c +++ b/libobs/obs-scene.c @@ -3301,10 +3301,10 @@ obs_sceneitem_t *obs_scene_insert_group(obs_scene_t *scene, const char *name, obs_sceneitem_t *item = obs_scene_add_internal(scene, sub_scene->source, last_item); - obs_scene_release(sub_scene); - - if (!items || !count) + if (!items || !count) { + obs_scene_release(sub_scene); return item; + } /* ------------------------- */ @@ -3345,6 +3345,7 @@ obs_sceneitem_t *obs_scene_insert_group(obs_scene_t *scene, const char *name, /* ------------------------- */ + obs_scene_release(sub_scene); return item; }