Skip to content

mask manager: fix use-after-free when selecting a group - #21861

Draft
da-phil wants to merge 1 commit into
darktable-org:masterfrom
da-phil:pl/fix_use_after_free_in_mask_manager
Draft

mask manager: fix use-after-free when selecting a group#21861
da-phil wants to merge 1 commit into
darktable-org:masterfrom
da-phil:pl/fix_use_after_free_in_mask_manager

Conversation

@da-phil

@da-phil da-phil commented Aug 15, 2026

Copy link
Copy Markdown
Contributor

Tree rows keep raw dt_iop_module_t pointers, but modules are freed on image change and on darkroom leave. The structure-hash early-out in gui_update can keep a store built for the previous set of modules, so selecting a group row called flags() through a dangling pointer and segfaulted.

Drop dead modules in _lib_masks_get_values() and invalidate the cached tree hash on image change and darkroom entry.

Fixes: #21852

Disclaimer: this work has been co-created with Claude.

Tree rows keep raw dt_iop_module_t pointers, but modules are freed on image
change and on darkroom leave. The structure-hash early-out in gui_update can
keep a store built for the previous set of modules, so selecting a group row
called flags() through a dangling pointer and segfaulted.

Drop dead modules in _lib_masks_get_values() and invalidate the cached tree
hash on image change and darkroom entry.
@da-phil da-phil mentioned this pull request Aug 15, 2026
1 task
@hats-np

hats-np commented Aug 16, 2026

Copy link
Copy Markdown

No such luck. Unsure if it's related to this, but it keeps segfaulting. Now when opening the quick access panel. Seems to not be related to this PR.
darktable_bt_HUAIU3.txt

@hats-np

hats-np commented Aug 16, 2026

Copy link
Copy Markdown

It's not related to this. I will test it again after I can use dt properly...

@da-phil

da-phil commented Aug 16, 2026

Copy link
Copy Markdown
Contributor Author

No such luck. Unsure if it's related to this, but it keeps segfaulting. Now when opening the quick access panel. Seems to not be related to this PR. darktable_bt_HUAIU3.txt

Thanks for checking, will have another look in the meantime...

@TurboGit

Copy link
Copy Markdown
Member

@da-phil : I'm a bit reluctant to merge this as we have the full revamp of mask support by @masterpiga, so probably better wait for it to land in Darktable and avoid conflicts.

@da-phil

da-phil commented Aug 19, 2026

Copy link
Copy Markdown
Contributor Author

@da-phil : I'm a bit reluctant to merge this as we have the full revamp of mask support by @masterpiga, so probably better wait for it to land in Darktable and avoid conflicts.

No worries, this PR was also meant to fix a bug which it didn't. I need to keep investigating.

@da-phil
da-phil marked this pull request as draft August 19, 2026 18:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Segfault opening mask group

3 participants