1
0
mirror of https://gitlab.com/OpenMW/openmw.git synced 2025-02-26 06:40:22 +00:00
Ilya Zhuravlev 8e7c01b561 loadingscreen: Fix UaF in loading screen.
When the CopyFramebufferToTextureCallback callback is called, in its operator() it resets setInitialDrawCallback by providing a NULL pointer.
However, this causes the callback to get deleted. In turn, the "this" pointer is invalidated.
When execution returns to DrawCallback::run, it accesses a _nestedCallback member of deleted "this" which is UB.
2018-12-24 14:18:26 -05:00
..
2018-12-02 23:10:29 +03:00