Security advisories not yet reported upstream (OBS Studio)

[zackees]

This thread tracks published obs-rust security advisories for bugs that also exist in upstream OBS Studio, until someone reports each one upstream.

Upstream takes security reports only at security@obsproject.com or on their Discord. GitHub private reporting is turned off on obsproject/obs-studio. Upstream also asks reporters to keep a bug confidential for 120 days.

Rules for this thread

• Only add an advisory after it has been published. Advisories still in triage stay private, so don't mention them here.
• Once you've reported an advisory upstream, reply with the date and the channel, and tick its box.

Not yet reported upstream

• GHSA-rjwf-j53r-47qr: heap use-after-free in signal_handler_remove_current (libobs/callback/signal.c). Found by @vpacher. Fixed here in callback: Fix signal callback removal across nesting, recursion and registration (split from #1464) #1556 (signal callbacks) and callback: Track the running global signal callback by index #1639 (global callbacks); the reporter confirmed both. Upstream has both paths, unchanged. Ready to send.

Ready-to-send report

Subject: Heap use-after-free in libobs/callback/signal.c (signal_handler_remove_current)

If a signal callback calls signal_handler_connect on the signal that is currently running, da_push_back can reallocate sig->callbacks.array. The thread-local current_signal_cb then points into the freed block. If that callback then calls signal_handler_remove_current(), it writes 1 byte into freed memory. AddressSanitizer reports this as a heap-use-after-free. The global-callback path (current_global_cb / signal_handler_connect_global) has the same problem.

Found by vpacher in the obs-rust fork. Fix: #1556 and #1639. Advisory: GHSA-rjwf-j53r-47qr

Backlog: earlier public fixes that upstream still lacks

Each fix below landed publicly in obs-rust. On 2026-10-21 the same file on obsproject/obs-studio master still had the bug. Each line can be sent as it stands, with the PR link as the patch.

• librtmp: Reject invalid Set Chunk Size values #115 librtmp HandleChangeChunkSize() accepts a chunk size with bit 31 set from the server. The resulting negative m_inChunkSize corrupts the chunk read and allocation arithmetic. Fix: reject values below 1. (network, medium-high)
• librtmp: Reject secureToken lengths that are not whole TEA blocks #232 librtmp DecodeTEA() takes a secureToken of any length from the server. A length of 0 reads v[-1] and divides by zero, and a length that isn't a multiple of 8 reads past the end of the token. Fix: reject both. (network, medium-high)
• librtmp: Bound AMF/AMF3 decode recursion depth #116 librtmp AMF_Decode and AMF3_Decode recurse once per nesting level with no limit, so a server's deeply nested objects overflow the stack. Fix: cap the depth. (network, DoS)
• librtmp: Bound AMF3 name logging and free class member names #230 librtmp AMF3_Decode logs the class and member names with %s although they aren't NUL-terminated, which reads out of bounds. It also leaks cd_props on every class decode. Fix: use %.*s and free cd_props. (network, medium)
• obs-outputs: Decode 32-bit RTMP/AMF fields without signed shifts #188 / obs-outputs: Make DecodeTEA's shifts well-defined #208 librtmp decodes 32-bit fields and TEA words with signed byte << 24 shifts on bytes from the server, which is undefined behaviour. Fix: cast to unsigned before shifting. (network, low)
• libobs: Keep AV1 OBU parsing inside the buffer #103 libobs/obs-av1.c parse_obu_header() sets obu_size = size - 1 without accounting for the extension byte or the buffer end, so a crafted OBU reads out of bounds. leb128() also overflows an int from the 5th byte. (media, medium)
• fix(libobs): get_ue_golomb UB on a truncated SPS (1 << 32) #17 libobs/obs-avc.c get_ue_golomb() runs 1 << 32 on a truncated SPS, which is undefined behaviour. Fix: cap i at 31 and shift an unsigned value. (media, low)
• libobs: Snapshot contexts during enumeration #730 libobs/obs.c obs_enum() reads context->next after the callback may have released the last reference, a use-after-free in obs_enum_outputs, obs_enum_encoders and obs_enum_services. It can also hand out encoders that are already being destroyed. Fix: enumerate a snapshot that holds references. (local, medium)
• linux-pipewire: Fix use-after-free in log message #393 linux-pipewire on_registry_global_remove_cb() logs device_id after g_hash_table_iter_remove() has freed it, a use-after-free on every camera unplug. Fix: swap the two lines. Upstream PR linux-pipewire: Fix use-after-free in log message obsproject/obs-studio#13698 is open but not merged. (local, low-medium)
• mac-avcapture: Clamp audio buffer list to MAX_AV_PLANES #124 mac-avcapture copies mNumberBuffers plane pointers into an array of MAX_AV_PLANES entries without checking the count, so a device reporting more than 8 buffers writes out of bounds. Fix: clamp the count. (device, low-medium)
• libobs: Reject recursive transition destinations #737 libobs transitions obs_transition_start() deadlocks on the transition's own mutex when the destination already contains that transition, directly or nested. Fix: reject recursive destinations. (local, DoS, borderline)
• libobs: Reject an image too large for a texture before decoding it #1474 image source decodes an image of any size in full before texture creation fails, for example about 2.5 GB for a 20480x11520 image. Fix: check against the device's maximum texture size in get_buffer2. (file, DoS, borderline)

Checked and left out: #200, #228 and #305 (functional bugs, not security), #582 (unreachable), #685 (the code exists only in obs-rust), and #1426 (a performance change on the Rust side only).