Skip to content

Commit

Permalink
fix a crash when saving screensets after more than one context shared…
Browse files Browse the repository at this point in the history
… an ID

1. a = CreateContext('Foo')
2. b = CreateContext('Foo')
3. delete a --> screenset handler of b is unregistered
4. Save screenset --> screenset handler of the now-freed a is called
5. Use-after-free!
  • Loading branch information
cfillion committed Oct 18, 2024
1 parent 3627852 commit 6e10e46
Show file tree
Hide file tree
Showing 3 changed files with 4 additions and 4 deletions.
2 changes: 1 addition & 1 deletion src/context.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -160,7 +160,7 @@ Context::Context(const ImGuiID id, const char *label, const int userConfigFlags)
Context::~Context()
{
setCurrent();
screenset_unregister(m_screensetID.data());
screenset_unregisterByParam(this);

if(m_imgui->WithinFrameScope)
endFrame(false);
Expand Down
4 changes: 2 additions & 2 deletions src/main.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -73,12 +73,12 @@ static bool loadAPI(void *(*getFunc)(const char *))
IMPORT(GetToggleCommandState),
IMPORT(plugin_getapi),
IMPORT(plugin_register),
IMPORT(realloc_cmd_ptr), // v5.26
IMPORT(realloc_cmd_ptr), // v5.95
IMPORT(ReaScriptError),
IMPORT(RecursiveCreateDirectory),
IMPORT(RefreshToolbar),
IMPORT(screenset_registerNew), // v4
IMPORT(screenset_unregister),
IMPORT(screenset_unregisterByParam),
IMPORT(ViewPrefs),

IMPORT(LICE_CreateBitmap),
Expand Down
2 changes: 1 addition & 1 deletion src/window.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -105,7 +105,7 @@ LRESULT CALLBACK Window::proc(HWND handle, const unsigned int msg,
break;
case WM_DESTROY:
RemoveProp(handle, CLASS_NAME);
screenset_unregister(self->m_screensetKey.data());
screenset_unregisterByParam(handle);
// Disable message passing to the derived class (not available at this point)
SetWindowLongPtr(handle, GWLP_USERDATA, 0);
// Announce to REAPER the window is no longer going to be valid
Expand Down

0 comments on commit 6e10e46

Please sign in to comment.