Skip to content

Bug: Uninitialized pointer ReadWriteLocker::lock_ causes UB on error paths #711

@grisutheguru

Description

@grisutheguru

Summary

The ReadWriteLocker class in src/video/videoframe.h has an uninitialized pointer member that causes undefined behavior when default-constructed instances are destroyed.

Details

// videoframe.h
class ReadWriteLocker {
public:
    ReadWriteLocker() = default;  // lock_ is NOT initialized
    // ...
    ~ReadWriteLocker()
    {
        if (lock_ != nullptr) {   // reads uninitialized memory!
            lock_->unlock();
        }
    }
private:
    QReadWriteLock* lock_;        // no default initializer
};

Default-constructed ReadWriteLocker instances are returned on error paths in toGenericObject() (line 708) and toToxYUVFrame() (line 320). When these are destroyed, the destructor reads the uninitialized lock_ pointer and may call unlock() on a garbage address.

Suggested Fix

private:
    QReadWriteLock* lock_ = nullptr;

One-character fix, eliminates an entire class of UB.

Impact

Potential crash on any video frame conversion error path. Would be caught by ASan/MSan.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions