[vlc-commits] lib: media_player: keep player libvlc instance

[Alexandre Janniaux]

vlc/vlc-3.0 | branch: master | Alexandre Janniaux <ajanni at videolabs.io> | Thu Jul  9 17:21:50 2020 +0200| [f6d17cd8e4ab636dbf83580244b77f7091a4e856] | committer: Alexandre Janniaux

lib: media_player: keep player libvlc instance

The media_player instance retains and releases the libvlc instance it's
created from. When using a different libvlc instance for media_player
and media, it was using the libvlc instance from the media_t object,
leading to the release of the wrong libvlc instance, and thus potential
use-after-free of one instance and leaks of the other.

It has been spotted since VLCKit creates a shared libvlc instance and
then can create a new libvlc instance in case the VLCMediaPlayer is
created with different options, which means that the VLCMediaPlayer and
the VLCMedia will be bound to different libvlc instances, triggering the
issue described in first paragraph and crashing.

/!\ This commit changes libvlc behaviour in the following case:

 - There's at least two libvlc instance, one being the parent of a media
   and the other being the parent of a media_player.

 - The media is set on the media_player.

 - A new media is played by the underlying vlc_player_t, in which case
   the new libvlc_media_t instance is now created with the player
   libvlc instance instead of the media libvlc instance.

 - The user call libvlc_media_player_get_media() on the player.

 - The user call preparse functions on the media.

Since this very case was leading to crash anyway, and is quite
intricate, it's probably not a very important change though.

Refs videolan/VLCKit#189, videolan/VLCKit#116

Cherry-picked from commit 12fa8556c092df472c38ab58517358a71a9d72de.

> http://git.videolan.org/gitweb.cgi/vlc/vlc-3.0.git/?a=commit;h=f6d17cd8e4ab636dbf83580244b77f7091a4e856
---

 lib/media_player.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/lib/media_player.c b/lib/media_player.c
index a9a22fee15..fda1091cc8 100644
--- a/lib/media_player.c
+++ b/lib/media_player.c
@@ -901,10 +901,6 @@ void libvlc_media_player_set_media(
     libvlc_media_retain( p_md );
     p_mi->p_md = p_md;
 
-    /* The policy here is to ignore that we were created using a different
-     * libvlc_instance, because we don't really care */
-    p_mi->p_libvlc_instance = p_md->p_libvlc_instance;
-
     unlock(p_mi);
 
     /* Send an event for the newly available media */