search

jdryg / vg-renderer

A vector graphics renderer for bgfx, based on ideas from NanoVG and ImDrawList (Dear ImGUI)
BSD 2-Clause "Simplified" License
504 stars 55 forks source link

Crashes when bx::alignedFree is passed a null pointer #31

Closed jfperusse closed 1 month ago

jfperusse commented 1 month ago

Since the migration from BX_ALIGNED_FREE to bx::alignedFree, projects using vg-renderer can crash because alignedFree does not include a null pointer check. BX_ALIGNED_FREE was calling realloc which includes such a check, which explains why projects were not crashing before.

One such crash is if you don't render any text before calling destroyContext, the following code will crash because ctx->m_TextQuads will be null.

bx::alignedFree(allocator, ctx->m_TextQuads, 16);
ctx->m_TextQuads = nullptr;

The crash is caused by the dereferencing of header in the following code from bx::alignedFree:

uint8_t* aligned = (uint8_t*)_ptr;
uint32_t* header = (uint32_t*)aligned - 1;
uint8_t* ptr = aligned - *header;
jdryg commented 1 month ago

Thanks for the bug report. Please send a PR with all the required fixes in case you found more than that in the meantime.

Regarding your question whether this should be fixed in vg-renderer or bx, I think it should be fixed here in vg-renderer. bx is just a helper library and all its quirks should be respected. Even if bx changes at some point, the null pointer test should be done in vg-renderer.

jfperusse commented 1 month ago

Thanks @jdryg. PR with the fix is up at https://github.com/jdryg/vg-renderer/pull/32.