The media_player instance retains and releases the libvlc instance it's
created from. When using a different libvlc instance for media_player
and media, it was using the libvlc instance from the media_t object,
leading to the release of the wrong libvlc instance, and thus potential
use-after-free of one instance and leaks of the other.
It has been spotted since VLCKit creates a shared libvlc instance and
then can create a new libvlc instance in case the VLCMediaPlayer is
created with different options, which means that the VLCMediaPlayer and
the VLCMedia will be bound to different libvlc instances, triggering the
issue described in first paragraph and crashing.
/!\ This commit changes libvlc behaviour in the following case:
- There's at least two libvlc instance, one being the parent of a media
and the other being the parent of a media_player.
- The media is set on the media_player.
- A new media is played by the underlying vlc_player_t, in which case
the new libvlc_media_t instance is now created with the player
libvlc instance instead of the media libvlc instance.
- The user call libvlc_media_player_get_media() on the player.
- The user call preparse functions on the media.
Since this very case was leading to crash anyway, and is quite
intricate, it's probably not a very important change though.
Refs videolan/VLCKit#189, videolan/VLCKit#116
Cherry-picked from commit 12fa8556c0.
Alexandre Janniaux
f6d17cd8e4