godotengine
/
godot
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fixed an access after free in ShaderLanguage::_reduce_expression. 

Passing an element reference of a vector to a push_back call to
that same vector can cause an access after free. This is because push_back
will resize the vector, reallocating if necessary, leaving the reference
referring to the freed memory.
Removed an instance of this usage here.
This commit is contained in:
Ibrahn Sahir 2018-09-19 14:28:19 +01:00
parent 9c2986abda
commit bff864818f
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
servers/visual/shader_language.cpp
View File

@ -3437,8 +3437,9 @@ ShaderLanguage::Node *ShaderLanguage::_reduce_expression(BlockNode *p_block, Sha
}
}
} else {
ConstantNode::Value value = values[0];
for (int i = 1; i < cardinality; i++) {
values.push_back(values[0]);
values.push_back(value);
}
}
} else if (values.size() != cardinality) {