obs_scene_find_source race condition/possible use-after-free

[gottagofaster236]

Operating System Info

Other

Other OS

No response

OBS Studio Version

31.0.0

OBS Studio Version (Other)

No response

OBS Studio Log URL

N/A

OBS Studio Crash Log URL

No response

Expected Behavior

There should be a way to call obs_scene_find_source and retain the reference to the sceneitem without a race condition

Current Behavior

obs_sceneitem_t *sceneitem = obs_scene_find_source(scene, "source");
// sceneitem can be freed by another thread between these two lines!
sceneitem = obs_sceneitem_addref(sceneitem);
if (!sceneitem) return;
// Do some work with the scene item
obs_sceneitem_release(sceneitem);

Steps to Reproduce

1. Launch a thread calls to obs_scene_find_source and then tries to retain the reference (in a loop)
2. Launch another thread that creates and deletes an item from a scene (in a loop)
3. Eventually obs_sceneitem_addref will try to increase the reference on an already-freed source corresponding to the (freed) sceneitem

Anything else we should know?

Very low probability of triggering, but still would be nice to have a version of this function that actually increments the reference under a mutex before returning