rust3ds / citro3d-rs

Rust bindings and safe wrappers for citro3d
https://rust3ds.github.io/citro3d-rs
14 stars 11 forks source link

C3D_BindProgram stores a pointer to a Program (use-after-free in bind_program) #37

Open Jhynjhiruu opened 10 months ago

Jhynjhiruu commented 10 months ago

C3D_BindProgram stores the passed-in pointer to a shader::Program in the C3D context. Currently, bind_program takes a reference to a Program, meaning that it's possible to pass in a Program that is dropped before the context attempts to use it (at the end of the frame, when it's rendered). This leads to a use-after-free and generally a crash. This can be avoided by the Instance taking ownership of the passed-in Program, and storing it in some kind of data type that can be Pinned.