fix: backport 2.7.1 crash fixes (macOS 26 WebView UAF + MakerWorld 3MF NULL-deref)#490
Merged
Merged
Conversation
On macOS 26.5+ the wxWebView created in WebView::CreateWebView can be destroyed before the CallAfter() callback that registers the "wx" script message handler fires. The callback captured the raw webView pointer and called AddScriptMessageHandler() on it unconditionally, dereferencing a dangling pointer. On Apple Silicon this trips pointer authentication and crashes (EXC_BAD_ACCESS / PAC failure); elsewhere it shows up as a long startup hang with steadily growing memory use. Guard the async callback by checking g_webviews (the list of live views) before touching the webView, and also remove a view from g_delay_webviews in ~WebViewRef so a pending flush never reaches an already-destroyed view. Fixes bambulab#11004 Fixes bambulab#10968
GLVolumeCollection::load_object_volume dereferences model_object->instances[instance_idx] (e.g. instance->get_transformation()) without validating the index. An object with an empty instances vector therefore dereferences a null/garbage ModelInstance* and crashes with EXC_BAD_ACCESS — a jump through a null vtable to 0x0. This happens when opening certain MakerWorld 3MFs: the object-color dialog calls update_obj_preview_origin_thumbnail(), which calls load_object_volume() with a hard-coded instance_idx of 0 for every object, including ones that have no instance yet during loading. Bail out early (returning -1, "no volume added") when model_object is null or volume_idx / instance_idx are out of range. The three other call sites either pass valid indices or ignore the return value. Fixes bambulab#11016
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backports my two upstream crash fixes into the fork via develop.
Both are small defensive guards, verified upstream. WebView.cpp +14, 3DScene.cpp +9.
Closes #489