Skip to content

lass: fix reverb use-after-free in ConstructorCommon - #97

Merged
passyur merged 1 commit into
mainfrom
fix/reverb-use-after-free
Jun 9, 2026
Merged

lass: fix reverb use-after-free in ConstructorCommon#97
passyur merged 1 commit into
mainfrom
fix/reverb-use-after-free

Conversation

@passyur

@passyur passyur commented Jun 9, 2026

Copy link
Copy Markdown
Member

Problem

Renders that apply reverb crash with a SIGSEGV on the first reverb call.

Root cause

Reverb::ConstructorCommon's first parameter was named percentReverb, which shadows the member of the same name. So:

Envelope* temp = new Envelope(*percentReverb);
delete percentReverb;
percentReverb = temp;   // updates the LOCAL parameter, never this->percentReverb
  • For the default / room-size constructors, the member was set before the call, then freed via the parameter alias and never reassigned → dangling.
  • For the Envelope* constructors, the constructor's own parameter also shadows the member, so they relied on ConstructorCommon to set it — which it never did → uninitialised.

Either way, the first reverb call does new Envelope(*percentReverb) on a bad pointer (and deletes it again), i.e. a use-after-free + double-free.

Fix

Assign this->percentReverb in ConstructorCommon (parameter renamed to percentReverbInput to remove the shadowing). This is the clearly intended behaviour — a private owned copy of the mix envelope.

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@passyur
passyur force-pushed the fix/reverb-use-after-free branch from 02fba93 to 391b7e7 Compare June 9, 2026 23:02
@passyur
passyur merged commit 741e8f3 into main Jun 9, 2026
4 checks passed
@passyur
passyur deleted the fix/reverb-use-after-free branch June 9, 2026 23:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant