Fix heap use after free accessing C4ObjectMenu::ClearObjectPtr

legacyclonk · Nov 18, 2023 · 4b4efc3 · 4b4efc3
1 parent 5a2f8ee
commit 4b4efc3
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 1 deletion.
diff --git a/src/C4ObjectMenu.cpp b/src/C4ObjectMenu.cpp
@@ -41,6 +41,11 @@ C4ObjectMenu::~C4ObjectMenu()
 	{
 		*ClearObjectPtr = nullptr;
 	}
+
+	if (IsDeleted)
+	{
+		*IsDeleted = true;
+	}
 }
 
 void C4ObjectMenu::Default()
@@ -511,6 +516,8 @@ bool C4ObjectMenu::MenuCommand(const char *szCommand, bool fIsCloseCommand)
 	{
 		ClearObjectPtr = &l_Object;
 	}
+	bool isDeleted{false};
+	IsDeleted = &isDeleted;
 
 	switch (eCallbackType)
 	{
@@ -531,7 +538,11 @@ bool C4ObjectMenu::MenuCommand(const char *szCommand, bool fIsCloseCommand)
 
 	if ((!l_Permanent || fIsCloseCommand) && l_Object) l_Object->AutoContextMenu(l_LastSelection);
 
-	ClearObjectPtr = nullptr;
+	if (!isDeleted)
+	{
+		ClearObjectPtr = nullptr;
+		IsDeleted = nullptr;
+	}
 
 	return true;
 }

diff --git a/src/C4ObjectMenu.h b/src/C4ObjectMenu.h
@@ -63,6 +63,7 @@ class C4ObjectMenu : public C4Menu
 	CallbackType eCallbackType;
 	bool UserMenu; // set for script created menus; user menus do CloseQuery and MenuSelection callbacks
 	bool CloseQuerying; // recursion check for close query callback
+	bool *IsDeleted{nullptr};
 
 	void LocalInit(C4Object *pObject, bool fUserMenu);