Skip to content

Commit 9c3966e

Browse files
authored
Fix use-after-free in gfx_widgets. (#18262)
Holding on to the task pointer is risky, because when the task queue is popped a message is pushed but the task may be freed. I made a very small-scale fix to just the new use-after-free that started happening with the alternative look.
1 parent 3fa2648 commit 9c3966e

2 files changed

Lines changed: 4 additions & 2 deletions

File tree

gfx/gfx_widgets.c

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -188,6 +188,7 @@ void gfx_widgets_msg_queue_push(
188188

189189
msg_widget->offset_y = 0;
190190
msg_widget->alpha = 1.0f;
191+
msg_widget->alternative_look = task && (task->flags & RETRO_TASK_FLG_ALTERNATIVE_LOOK);
191192

192193
msg_widget->width = 0;
193194

@@ -358,7 +359,7 @@ void gfx_widgets_msg_queue_push(
358359
msg_widget->msg_len = _len;
359360
msg_widget->msg_transition_animation = 0;
360361

361-
if (!((task->flags & RETRO_TASK_FLG_ALTERNATIVE_LOOK) > 0))
362+
if (!msg_widget->alternative_look)
362363
{
363364
gfx_animation_ctx_entry_t entry;
364365

@@ -1168,7 +1169,7 @@ static void gfx_widgets_draw_task_msg(
11681169
size_t task_percentage_offset = 0;
11691170
char task_percentage[256] = "";
11701171
bool draw_msg_new = false;
1171-
bool msg_alternative = (task_get_flags(msg->task_ptr) & RETRO_TASK_FLG_ALTERNATIVE_LOOK);
1172+
bool msg_alternative = msg->alternative_look;
11721173

11731174
if (msg->msg_new)
11741175
draw_msg_new = !string_is_equal(msg->msg_new, msg->msg);

gfx/gfx_widgets.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -185,6 +185,7 @@ typedef struct disp_widget_msg
185185
int8_t task_progress;
186186
/* How many tasks have used this notification? */
187187
uint8_t task_count;
188+
bool alternative_look;
188189
} disp_widget_msg_t;
189190

190191
typedef struct dispgfx_widget

0 commit comments

Comments
 (0)