Skip to content

Commit 9b90b12

Browse files
Fix use-after-free in builtin_stringWidth/stringHeight
On the desktop target ASAN caught it, but on the PS2 target this manifested as the text jittering back and forth
1 parent 64eb6c8 commit 9b90b12

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

src/vm_builtins.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3889,7 +3889,6 @@ static RValue builtin_stringWidth(VMContext* ctx, RValue* args, int32_t argCount
38893889
char* str = RValue_toString(args[0]);
38903890

38913891
PreprocessedText processed = TextUtils_preprocessGmlTextIfNeeded(runner, str);
3892-
free(str);
38933892
int32_t textLen = (int32_t) strlen(processed.text);
38943893

38953894
// Find the widest line
@@ -3913,6 +3912,7 @@ static RValue builtin_stringWidth(VMContext* ctx, RValue* args, int32_t argCount
39133912
}
39143913

39153914
PreprocessedText_free(processed);
3915+
free(str);
39163916
return RValue_makeReal((GMLReal) (maxWidth * font->scaleX));
39173917
}
39183918

@@ -3927,10 +3927,10 @@ static RValue builtin_stringHeight(VMContext* ctx, RValue* args, int32_t argCoun
39273927
char* str = RValue_toString(args[0]);
39283928

39293929
PreprocessedText processed = TextUtils_preprocessGmlTextIfNeeded(runner, str);
3930-
free(str);
39313930
int32_t textLen = (int32_t) strlen(processed.text);
39323931
int32_t lineCount = TextUtils_countLines(processed.text, textLen);
39333932
PreprocessedText_free(processed);
3933+
free(str);
39343934

39353935
return RValue_makeReal((GMLReal) ((float) lineCount * (float) font->emSize * font->scaleY));
39363936
}

0 commit comments

Comments
 (0)