Skip to content

VDR: Fix use after free crash#2733

Merged
panos-lunarg merged 4 commits intoLunarG:devfrom
panos-lunarg:VDR_fix_use_after_free_crash
Mar 14, 2026
Merged

VDR: Fix use after free crash#2733
panos-lunarg merged 4 commits intoLunarG:devfrom
panos-lunarg:VDR_fix_use_after_free_crash

Conversation

@panos-lunarg
Copy link
Contributor

Reserving space in the build_infos vector should fix a crash of referencing a dangling pointer when the infoCount was larger than 1.

@panos-lunarg panos-lunarg requested a review from a team as a code owner February 27, 2026 07:57
@panos-lunarg panos-lunarg force-pushed the VDR_fix_use_after_free_crash branch from a58e9a0 to 8b53115 Compare February 27, 2026 08:01
@panos-lunarg panos-lunarg added approved-to-run-ci Can run CI check on internal LunarG machines and removed approved-to-run-ci Can run CI check on internal LunarG machines labels Feb 27, 2026
@panos-lunarg panos-lunarg force-pushed the VDR_fix_use_after_free_crash branch 5 times, most recently from 4f14e40 to c6d8064 Compare March 5, 2026 17:18
@bradgrantham-lunarg
Copy link
Contributor

Does this argue that build_infos should be an unordered_map on int that is checked with at before use?

@panos-lunarg panos-lunarg force-pushed the VDR_fix_use_after_free_crash branch 3 times, most recently from 90aaf35 to 3f12bdb Compare March 6, 2026 12:36
@panos-lunarg
Copy link
Contributor Author

Does this argue that build_infos should be an unordered_map on int that is checked with at before use?

unordered_map feels like an overkill as build_infos is just an array of things that is constructed once. There's no need to search in it, or add or remove objects after it is populated.
How about moving the call to reserve in the constructor? This should make it more robust

@panos-lunarg panos-lunarg force-pushed the VDR_fix_use_after_free_crash branch 3 times, most recently from 9aae0d8 to 326026c Compare March 13, 2026 06:22
Copy link
Contributor

@bradgrantham-lunarg bradgrantham-lunarg left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We discussed having a follow-on to this PR making some changes to bare pointers in these structures, but this PR 2733 has been in testing for some time so should get merged with the follow-on shortly after. Thank you!

Reserving space in the build_infos vector should fix a crash of
referencing a dangling pointer when the infoCount was larger than 1.
Remove return causing interruption of loop
@panos-lunarg panos-lunarg force-pushed the VDR_fix_use_after_free_crash branch from 326026c to d4e190f Compare March 14, 2026 12:02
@panos-lunarg panos-lunarg merged commit 97d077c into LunarG:dev Mar 14, 2026
8 checks passed
bradgrantham-lunarg pushed a commit to bradgrantham-lunarg/gfxreconstruct that referenced this pull request Mar 16, 2026
* VDR: Fix use after free crash

Reserving space in the build_infos vector should fix a crash of
referencing a dangling pointer when the infoCount was larger than 1.

* VDR: Remove return

Remove return causing interruption of loop

* VDR: Fix null entry in json output

* VDR: Add new test for VDR_2733
github-merge-queue bot pushed a commit that referenced this pull request Mar 16, 2026
* Fix issues for d3d12 (#2633)

1.Add RASTERIZER1 and RASTERIZER2 support in CreatePipelineState
2.Add no array struct pointer handling
3.Add DEPTH_STENCIL2 and SERIALIZED_ROOT_SIGNATURE support in CreatePipelineState
4.Fix incorrect code

* Remove busy-wait loops for vkGetEventStatus and vkGetQueryPoolResult (#2723)

- no more looping, no blocking-wait, just invoke func once, be happy with whatever it returns
- allow-list both functions, other return-types are expected and should be benign
- instead log debug-messages
- behavior is more predictable and better matches GFXR guidelines
- log-spam is reduced significantly for replay of proton/DXVK

* Revert "Fix memory leak during D3D12 capture (#2740)" (#2771)

This reverts commit 865a785.

* fix NVIDIA label (#2772)

* Remove concurrency line from extended manual jenkinsfile

* Change block allocation to HLA in BlockBatch

Implement block batch targeted hybrid linear allocator

* Remove DispatchStore in favor of all HLA model

   Also Cleanups for HLA

   Streamlined allocator reset and block buffer
   Fix replay time decompression glass jaw error.
   Change to decompression policy kAlways to optimize
   replay performance.

   Cleanup BlockBuffer

   Cleanup iterator safety

   Review/CI based fixes

   Iterator performance tuning

   Remove unused HeapBufferPool

* Fix memory leak during D3D12 capture (#2775)

* Fix memory leak during D3D12 capture

* Update test_suite.ref

* replay: Add --idle-before-submit option

Add a replay option to wait for the GPU to become idle before submitting
each command buffer to a queue.

* Update headers to 1.4.345 (#2780)

* Update headers to 1.4.345

* Add python pyparsing module dependency to github actions

* VDR: Fix use after free crash (#2733)

* VDR: Fix use after free crash

Reserving space in the build_infos vector should fix a crash of
referencing a dangling pointer when the infoCount was larger than 1.

* VDR: Remove return

Remove return causing interruption of loop

* VDR: Fix null entry in json output

* VDR: Add new test for VDR_2733

* Fix test_suite.ref (#2784)

* VDR: Some changes in generated filenames (#2726)

- The capture filename prefix is removed from the dumped files. This
should help shorten the generated names.
- Add the command index that was missing from some filenames. This
should help reduce naming collisions

* Foo

---------

Co-authored-by: zongdu-arm <zongshou.du@arm.com>
Co-authored-by: Fabian Schmidt <165773884+fabian-lunarg@users.noreply.github.com>
Co-authored-by: Beau Bennett <beau@lunarg.com>
Co-authored-by: John Zulauf <jzulauf@lunarg.com>
Co-authored-by: Locke Lin <47329816+locke-lunarg@users.noreply.github.com>
Co-authored-by: Antonio Caggiano <antonio@lunarg.com>
Co-authored-by: David Pinedo <david@lunarg.com>
Co-authored-by: Panagiotis Apostolou <104391532+panos-lunarg@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved-to-run-ci Can run CI check on internal LunarG machines

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants