sam/sfizz
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix a used-after-free bug

Browse source 
We took a reference to a target member, while possibly moving the vector of all targets.
This commit is contained in:
Paul Fd 2024-02-10 13:58:56 +01:00 • committed by Paul Ferrand
parent f7beeffd2a
commit 7f501666b1
2 changed files with 13 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
src/sfizz/modulations/ModMatrix.cpp
View file

@ -205,13 +205,20 @@ bool ModMatrix::connect(SourceId sourceId, TargetId targetId, float sourceDepth,
if (sourceIndex >= impl.sources_.size() || targetIndex >= impl.targets_.size()) if (sourceIndex >= impl.sources_.size() || targetIndex >= impl.targets_.size())
return false; return false;
TargetId sourceDepthModId;
// We need to register the target _before_ taking a reference to target.connectedSources
// because if the targets_ vector is reallocated, all targets' connected sources will be moved
// and conn will point to freed memory.
if (sourceDepthMod)
sourceDepthModId = registerTarget(sourceDepthMod);
Impl::Target& target = impl.targets_[targetIndex]; Impl::Target& target = impl.targets_[targetIndex];
Impl::ConnectionData& conn = target.connectedSources[sourceIndex]; Impl::ConnectionData& conn = target.connectedSources[sourceIndex];
conn.sourceDepth_ = sourceDepth; conn.sourceDepth_ = sourceDepth;
conn.sourceDepthMod_ = sourceDepthMod; conn.sourceDepthMod_ = sourceDepthMod;
if (sourceDepthMod) if (sourceDepthModId.valid())
conn.sourceDepthModId_ = registerTarget(sourceDepthMod); conn.sourceDepthModId_ = sourceDepthModId;
conn.velToDepth_ = velToDepth; conn.velToDepth_ = velToDepth;

4
src/sfizz/modulations/ModMatrix.h
View file

@ -57,6 +57,8 @@ public:
* @brief Register a modulation source inside the matrix. * @brief Register a modulation source inside the matrix.
* If it is already present, it just returns the existing id. * If it is already present, it just returns the existing id.
* *
* @note Might move the sources_ vector.
*
* @param key source key * @param key source key
* @param gen generator * @param gen generator
* @param flags source flags * @param flags source flags
@ -66,6 +68,8 @@ public:
/** /**
* @brief Register a modulation target inside the matrix. * @brief Register a modulation target inside the matrix.
* *
* @note Might move the targets_ vector.
*
* @param key target key * @param key target key
* @param region target region * @param region target region
* @param flags target flags * @param flags target flags