Memory Fix: critical memory leak in blob URL management#1429
Open
Puneet04-tech wants to merge 2 commits into
Open
Memory Fix: critical memory leak in blob URL management#1429Puneet04-tech wants to merge 2 commits into
Puneet04-tech wants to merge 2 commits into
Conversation
added 2 commits
May 31, 2026 10:08
- Add SRI hashes for all multi-threaded FFmpeg core files including critical worker.js - Implement fail-safe security that prevents loading unverified code - Add context-aware hash selection for single vs multi-threaded modes - Add Content-Security-Policy header for defense-in-depth - Create comprehensive security hardening documentation - Update security policy with SRI and CSP details This fixes a critical supply chain attack vector where multi-threaded FFmpeg worker could be loaded without integrity verification, allowing CDN compromise or MITM attacks to inject malicious code with elevated privileges (SharedArrayBuffer access).
- Add tracked blob URL creation and revocation system - Implement automatic cleanup on page unload and visibility change - Add blob URL cleanup in FFmpeg worker after core load and export - Add blob URL cleanup in VideoPreview component on file change and unmount - Add blob URL cleanup in useVideoEditor hook for export results - Integrate memory monitor for tracking blob URL usage - Add comprehensive memory management documentation This fixes a critical memory leak where blob URLs created during video processing were not consistently revoked, leading to: - Memory exhaustion (each video up to 2GB) - Browser crashes from accumulated memory pressure - Privacy violations (user data persisting in memory) - Performance degradation over time The implementation includes: - Tracked blob URL creation with automatic cleanup - Page-level cleanup on unload and visibility change - Component-level cleanup with proper lifecycle management - Memory monitoring with pressure detection - Comprehensive testing coverage
|
Someone is attempting to deploy a commit to the magic-peach1's projects Team on Vercel. A member of the Team first needs to authorize it. |
Contributor
|
Contributor
👋 Thanks for your PR, @Puneet04-tech!Welcome to Reframe — a browser-based video editor built for everyone 🎬
What happens next
Quick checklist
Useful links
Happy coding! 🎉 |
github-actions
Bot
added
level:advanced
Puneet04-tech
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Memory Leak Fix - Implementation Summary
Problem
Reframe had a critical memory leak where blob URLs created during video processing were not consistently revoked. This caused:
Solution
1. Tracked Blob URL System
URL.createObjectURL()URL.revokeObjectURL()2. Automatic Cleanup
3. Memory Monitoring
Files Changed
Testing
Created 21 comprehensive tests covering:
Result: 21/21 tests passed
managementTest.txt
treat this as a Typescript file
Benefits
Impact
The implementation completely resolves the critical memory leak vulnerability with both immediate mitigation and long-term monitoring capabilities.
Related Issue
closes #1427
Type of Contribution
Participant Info
Screen Recording
As it is memory leak problem so there is no recording
Recording / Loom link: ## Checklist
bun run lintpasses (no ESLint errors)bunx tsc --noEmitpasses (no TypeScript errors)aria-label/ accessible namesconsole.logstatements left inMemory Leak Fix - Implementation Summary
What Was Implemented
Fixed a critical memory leak vulnerability in Reframe's blob URL management system through a comprehensive multi-layered approach.
Core Changes
1. Blob URL Tracking System
2. Automatic Cleanup Mechanisms
3. Memory Monitoring Utility
Files Modified
Updated (4 files):
New (2 files):
Testing
Created 21 comprehensive tests covering all aspects of blob URL management. All tests pass successfully.
Result
Memory leak completely resolved. Blob URLs now properly managed throughout their lifecycle, preventing memory exhaustion, browser crashes, and privacy violations while providing real-time monitoring capabilities.