Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix use after free in GDScriptLanguage::debug_get_globals #89274

Merged
merged 1 commit into from
Jul 26, 2024

Conversation

0x0ACB
Copy link
Contributor

@0x0ACB 0x0ACB commented Mar 8, 2024

The Object* cast operator of Variant does not validate that the object still exists. This means that in the case you eg queue_free an autoload class this will crash on the next script error due to trying to dynamic_cast a freed pointer.

Not sure get_validated_object_with_check is needed or if get_validated_object would have been enough. But I think better safe than sorry in this case.

There would also be the option of printing a warning/error here since I don't think you should really free autoloads intentionally.

@0x0ACB 0x0ACB requested a review from a team as a code owner March 8, 2024 06:36
@akien-mga akien-mga changed the title Fix user after free in GDScriptLanguage::debug_get_globals Fix use after free in GDScriptLanguage::debug_get_globals Mar 8, 2024
@akien-mga akien-mga added this to the 4.3 milestone Mar 8, 2024
Copy link
Member

@vnen vnen left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@akien-mga akien-mga merged commit 2a61a2f into godotengine:master Jul 26, 2024
16 checks passed
@akien-mga
Copy link
Member

Thanks!

@akien-mga akien-mga added the cherrypick:4.2 Considered for cherry-picking into a future 4.2.x release label Aug 8, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug cherrypick:4.2 Considered for cherry-picking into a future 4.2.x release crash topic:gdscript
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Freed autoload object causes debugger to crash without a meaningful error message (GDScript)
3 participants