#1152979 obs-studio: crashes with "free(): invalid pointer" when adding a V4L2 source on a non-USB camera

Package:
obs-studio
Source:
obs-studio
Description:
recorder and streamer for live video content
Submitter:
Carlos Castro
Date:
2026-11-03 23:05:02 UTC
Severity:
normal
#1152979#5
Date:
2026-11-03 23:03:18 UTC
From:
To:
Dear Maintainer,

Adding a "Video Capture Device (V4L2)" source makes OBS abort with
"free(): invalid pointer" as soon as the source properties are built.

Steps to reproduce:
1. Machine with a built-in PCI camera and no USB cameras, so /dev/v4l/by-id/
   does not exist (here: MacBookPro11,1, Apple FaceTime HD via the
   out-of-tree facetimehd module, only /dev/v4l/by-path/ exists).
2. Start OBS (a fresh configuration also crashes), create a scene.
3. Add a "Video Capture Device (V4L2)" source.
Result: OBS aborts. Reproduced with fresh config, on Wayland and under X11.
The camera itself works: v4l2-ctl --stream-mmap captures frames normally.

Backtrace (gdb, no debug symbols):
 #5 free () from libc.so.6
 #6 ??? from /usr/lib/x86_64-linux-gnu/obs-plugins/linux-v4l2.so
 #7 ??? from linux-v4l2.so
 #8 obs_source_properties () from libobs.so.0

Analysis (from reading the source, not confirmed with debug symbols):
The Debian patch linux-v4l2-Save-device-by-id-or-path.patch (from upstream
PR 6493, closed upstream) rewrites the device listing in
v4l2_device_add_devices_from(). It declares "struct dirent **namelist;"
without an initial value, scans /dev/v4l/by-id/ with scandir(), and calls
free(namelist) unconditionally at the end. When the directory does not
exist,
scandir() fails and leaves namelist uninitialized, so free() receives a
garbage pointer.

Fix: initialize it to NULL ("struct dirent **namelist = NULL;"). Patch
attached.

Testing: I rebuilt linux-v4l2.so from the Debian source package with this
one-line change and installed it over the packaged plugin. Adding the V4L2
source and opening its properties no longer crashes, and OBS exits cleanly.

Possibly related: #1151092 (crash when reconnecting a USB capture device,
also
in code added by the same patch, but as far as I can tell a different code
path), and the salsa merge request proposing to revert this patch
(multimedia-team/obs-studio MR 9).