mask manager: fix use-after-free when selecting a group - #21861
Conversation
Tree rows keep raw dt_iop_module_t pointers, but modules are freed on image change and on darkroom leave. The structure-hash early-out in gui_update can keep a store built for the previous set of modules, so selecting a group row called flags() through a dangling pointer and segfaulted. Drop dead modules in _lib_masks_get_values() and invalidate the cached tree hash on image change and darkroom entry.
|
No such luck. Unsure if it's related to this, but it keeps segfaulting. Now when opening the quick access panel. Seems to not be related to this PR. |
|
It's not related to this. I will test it again after I can use dt properly... |
Thanks for checking, will have another look in the meantime... |
|
@da-phil : I'm a bit reluctant to merge this as we have the full revamp of mask support by @masterpiga, so probably better wait for it to land in Darktable and avoid conflicts. |
No worries, this PR was also meant to fix a bug which it didn't. I need to keep investigating. |
Tree rows keep raw dt_iop_module_t pointers, but modules are freed on image change and on darkroom leave. The structure-hash early-out in gui_update can keep a store built for the previous set of modules, so selecting a group row called flags() through a dangling pointer and segfaulted.
Drop dead modules in _lib_masks_get_values() and invalidate the cached tree hash on image change and darkroom entry.
Fixes: #21852
Disclaimer: this work has been co-created with Claude.