Skip to content

Commit 9449a88

Browse files
committed
Fix StringName double-free
The library accidentally took ownership of a StringName passed in (get_virtual callback). This caused the destructor to run multiple times, creating UB and random crashes. Re-enables the StringName destructor, which was disabled in 70da3fe.
1 parent 0c94f81 commit 9449a88

File tree

2 files changed

+5
-3
lines changed

2 files changed

+5
-3
lines changed

godot-core/src/builtin/string_name.rs

+1-1
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ impl GodotFfi for StringName {
5353
impl_builtin_traits! {
5454
for StringName {
5555
Clone => string_name_construct_copy;
56-
// Drop => string_name_destroy;
56+
Drop => string_name_destroy;
5757
Eq => string_name_operator_equal;
5858
Ord => string_name_operator_less;
5959
}

godot-core/src/registry.rs

+4-2
Original file line numberDiff line numberDiff line change
@@ -314,8 +314,10 @@ pub mod callbacks {
314314
_class_user_data: *mut std::ffi::c_void,
315315
name: sys::GDNativeStringNamePtr,
316316
) -> sys::GDNativeExtensionClassCallVirtual {
317-
let method_name = StringName::from_string_sys(name);
318-
let method_name = method_name.to_string();
317+
// This string is not ours, so we cannot call the destructor on it.
318+
let borrowed_string = StringName::from_string_sys(name);
319+
let method_name = borrowed_string.to_string();
320+
std::mem::forget(borrowed_string);
319321

320322
T::__virtual_call(method_name.as_str())
321323
}

0 commit comments

Comments
 (0)