Samsung / rlottie

A platform independent standalone library that plays Lottie Animation.
Other
1.15k stars 223 forks source link

Use after free in surface cache code #524

Open X-Ryl669 opened 2 years ago

X-Ryl669 commented 2 years ago

Found this via Valgrind:

   VBitmap make_surface(
        size_t width, size_t height,
        VBitmap::Format format = VBitmap::Format::ARGB32_Premultiplied)
    {
        if (mCache.empty()) return {width, height, format};

        auto surface = mCache.back();
        surface.reset(width, height, format);

        mCache.pop_back();
        return surface;
    }

    void release_surface(VBitmap &surface) { mCache.push_back(surface); }

Here we have the sequence:

  1. VBitmap & surface = mCache.back() => we take a reference on the last element
  2. cache.pop_back(); => delete the last element in the vector
  3. return surface; => return a dangling reference on a deleted element

Instead of auto surface here, it should be VBitmap surface since auto resolve to a reference (vector::back() returns a reference on its last element)