mirror of
https://github.com/libretro/RetroArch
synced 2025-04-16 17:43:02 +00:00
c00b6e0750
`menu_animation_update` enumerates `menu_animation.list` to process each `tween`. It was observed that some tweens execute a callback that pushes more animations via `menu_animation_push`. During the push, if the tween `list` does not have enough space, a `realloc` occurs, potentially invalidating the existing list. The remaining pointer access in menu_animation_update is therefore invalid. Best case is the memory is unused and thus does not affect the program. Worst case is memory corruption.