Fix volmeter use-after-free on audio thread during teardown

The volmeter held only a weak reference to its attached source. When the
source was concurrently going to refcount 0, obs_volmeter_detach_source's
weak->strong upgrade returned NULL and it skipped
obs_source_remove_audio_capture_callback, leaving a dangling
{volmeter_source_data_received, freed-volmeter} entry in the source's
audio_cb_list. The WASAPI RT capture thread could then call into the freed
volmeter before obs_source_destroy frees that list, crashing in
signal_levels_updated (EXCEPTION_ACCESS_VIOLATION_EXEC) or the peak path
(EXCEPTION_ACCESS_VIOLATION_READ).

Hold a strong reference to the attached source for the lifetime of the
attachment (via findAndRef), released only after detach. The source can no
longer reach refcount 0 while attached, so the detach always removes the
audio capture callback before the volmeter is freed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: summeroff

obs-studio-server/source/osn-volmeter.cpp

@@ -116,7 +116,7 @@ void osn::Volmeter::Attach(void *data, const int64_t id, const std::vector<ipc::
 		PRETTY_ERROR_RETURN(ErrorCode::InvalidReference, "Invalid Meter reference.");
 	}
 
-	auto source = osn::Source::Manager::GetInstance().find(uid_source);
+	OBSSourceAutoRelease source = osn::Source::Manager::GetInstance().findAndRef(uid_source);
 	if (!source) {
 		PRETTY_ERROR_RETURN(ErrorCode::InvalidReference, "Invalid Source reference.");
 	}
@@ -126,6 +126,9 @@ void osn::Volmeter::Attach(void *data, const int64_t id, const std::vector<ipc::
 	}
 
 	meter->uid_source = uid_source;
+	// Hold the source alive while attached (replaces any previous attachment's ref,
+	// which obs_volmeter_attach_source has already detached above).
+	meter->source_ref = std::move(source);
 
 	rval.push_back(ipc::value((uint64_t)ErrorCode::Ok));
 	AUTO_DEBUG;
@@ -143,6 +146,9 @@ void osn::Volmeter::Detach(void *data, const int64_t id, const std::vector<ipc::
 
 	meter->uid_source = INVALID_ID;
 	obs_volmeter_detach_source(meter->self);
+	// Release only after detach, so the weak-ref upgrade inside detach succeeds and the
+	// audio capture callback is removed cleanly.
+	meter->source_ref = nullptr;
 
 	rval.push_back(ipc::value((uint64_t)ErrorCode::Ok));
 	AUTO_DEBUG;

obs-studio-server/source/osn-volmeter.hpp

@@ -22,6 +22,7 @@
 #include <queue>
 #include <array>
 #include "obs.h"
+#include <obs.hpp>
 #include "utility.hpp"
 
 extern std::mutex mtx;
@@ -52,6 +53,12 @@ class Volmeter {
 	utility::unique_id::id_t id = INVALID_ID;
 	utility::unique_id::id_t uid_source = INVALID_ID;
 
+	// Strong reference to the attached source, held for the lifetime of the attachment.
+	// Keeps the source alive so obs_volmeter_detach_source can always remove the audio
+	// capture callback before the volmeter is freed, avoiding a dangling entry that the
+	// audio thread would call into.
+	OBSSourceAutoRelease source_ref;
+
 	struct AudioData {
 		std::array<float, MAX_AUDIO_CHANNELS> magnitude{};
 		std::array<float, MAX_AUDIO_CHANNELS> peak{};