[vlc-commits] [Git][videolan/vlc][master] lib: media: fix data race title meta fallback

[Jean-Baptiste Kempf (@jbk)]

Jean-Baptiste Kempf pushed to branch master at VideoLAN / VLC


Commits:
f4e15a58 by Alaric Senat at 2026-07-18T12:32:19+02:00
lib: media: fix data race title meta fallback

libvlc_media_get_meta() falls back to `input_item_t.psz_name` when the
Title meta is unset, but reads the field directly, without holding the
item lock. This means that the unlocked strdup() is racy and can lead to
UB if called concurrently on title changes.

input_item_GetTitleFbName() implements this fallback while holding the
lock. Let's use it instead.

It should be noted that it also treats an empty Title as unset, which
the open-coded fallback did not. This behavior change is correct and
actually fixes another subtle bug.

The race was caught via LLM review and reproduced with tsan while working on
vlc-rs:

WARNING: ThreadSanitizer: data race (pid=87948)
  Write of size 8 at 0x723800000000 by thread T1:
    #0 input_item_SetName ../src/input/item.c:266 (libvlccore.so.9+0x48165)
    #1 renamer ../test/libvlc/media_title_race.c:54 (test_libvlc_media_title_race+0x40093d)

  Previous read of size 8 at 0x723800000000 by thread T2:
    #0 libvlc_media_get_meta ../lib/media.c:433 (libvlc.so+0x8a58)
    #1 reader ../test/libvlc/media_title_race.c:70 (test_libvlc_media_title_race+0x4008a5)

  Location is heap block of size 216 at 0x723800000000 allocated by main thread:
    #0 calloc <null> (libtsan.so.2+0x4bb4f)
    #1 input_item_NewExt ../src/input/item.c:998 (libvlccore.so.9+0x4a9a6)
    #2 libvlc_media_new_as_node ../lib/media.c:347 (libvlc.so+0x8428)
    #3 main ../test/libvlc/media_title_race.c:91 (test_libvlc_media_title_race+0x400659)

  Thread T1 (tid=87950, running) created by main thread at:
    #0 pthread_create <null> (libtsan.so.2+0x1fd4f)
    #1 vlc_clone_attr ../src/posix/thread.c:179 (libvlccore.so.9+0x11cf4a)
    #2 vlc_clone ../src/posix/thread.c:190 (libvlccore.so.9+0x11cf4a)
    #3 main ../test/libvlc/media_title_race.c:101 (test_libvlc_media_title_race+0x4006bf)

  Thread T2 (tid=87951, running) created by main thread at:
    #0 pthread_create <null> (libtsan.so.2+0x1fd4f)
    #1 vlc_clone_attr ../src/posix/thread.c:179 (libvlccore.so.9+0x11cf4a)
    #2 vlc_clone ../src/posix/thread.c:190 (libvlccore.so.9+0x11cf4a)
    #3 main ../test/libvlc/media_title_race.c:102 (test_libvlc_media_title_race+0x4006db)

- - - - -


1 changed file:

- lib/media.c


Changes:

=====================================
lib/media.c
=====================================
@@ -424,14 +424,14 @@ char *libvlc_media_get_meta( libvlc_media_t *p_md, libvlc_meta_t e_meta )
     {
         psz_meta = input_item_GetNowPlayingFb( p_md->p_input_item );
     }
+    else if( e_meta == libvlc_meta_Title )
+    {
+        psz_meta = input_item_GetTitleFbName( p_md->p_input_item );
+    }
     else
     {
         psz_meta = input_item_GetMeta( p_md->p_input_item,
                                              libvlc_to_vlc_meta[e_meta] );
-        /* Should be integrated in core */
-        if( psz_meta == NULL && e_meta == libvlc_meta_Title
-         && p_md->p_input_item->psz_name != NULL )
-            psz_meta = strdup( p_md->p_input_item->psz_name );
     }
     return psz_meta;
 }



View it on GitLab: https://code.videolan.org/videolan/vlc/-/commit/f4e15a5846b5d7fc6848c4984fdf28b1a50bac7f

-- 
View it on GitLab: https://code.videolan.org/videolan/vlc/-/commit/f4e15a5846b5d7fc6848c4984fdf28b1a50bac7f
You're receiving this email because of your account on code.videolan.org. Manage all notifications: https://code.videolan.org/-/profile/notifications | Help: https://code.videolan.org/help