Fix UAF in animation end callback if callback deletes the animation (#2389)

Removes use after free when the end callback deletes the animation as
long as `m_bRemoveEndAfterRan` is false.
This commit is contained in:
outfoxxed 2023-05-29 00:51:58 -07:00 committed by GitHub
parent 438d063ec6
commit 409ff027f8
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23

View file

@ -268,8 +268,10 @@ class CAnimatedVariable {
// methods // methods
void onAnimationEnd() { void onAnimationEnd() {
if (m_fEndCallback) { if (m_fEndCallback) {
// loading m_bRemoveEndAfterRan before calling the callback allows the callback to delete this animation safely if it is false.
auto removeEndCallback = m_bRemoveEndAfterRan;
m_fEndCallback(this); m_fEndCallback(this);
if (m_bRemoveEndAfterRan) if (removeEndCallback)
m_fEndCallback = nullptr; // reset m_fEndCallback = nullptr; // reset
} }
} }