google / filament

Filament is a real-time physically based rendering engine for Android, iOS, Windows, Linux, macOS, and WebGL2
https://google.github.io/filament/
Apache License 2.0
17.35k stars 1.83k forks source link

fix use-after-free dereference risk #7939

Closed pixelflinger closed 6 days ago

pixelflinger commented 1 week ago

Texture handles were resolved to pointers when updating a SamplerGroup, as that point the handle was checked for use-after-free. However, the texture could be destroyed later while still active in the SamplerGroup, this would result in using the pointer which now contains garbage.

We now keep the handle and resolve the texture when binding samplers to the program; which will also perform the use-after-free check.