15450a6d0c
When creating our own "owned and local" protobuf message in `StartProtobufMessage`, `m_FakeEngineBuffer` is used to track that message. In `EndMessage` the message is optionally converted to a "private" one with the right abi on osx and passed to the engine's `SendUserMessage`. On linux and windows the same message as in the `m_FakeEngineBuffer` is passed though without conversion. `engine->SendUserMessage` has a vtable hook which sets `m_FakeEngineBuffer` to the passed argument. `m_FakeEngineBuffer` frees the message it previously held, since it's "owned" from `StartProtobufMessage`, but that's the same one that's passed in as argument so a use-after-free in the engine happens when the now-freed message pointer is forwarded to the real `SendUserMessage` in the engine. The message created in `StartProtobufMessage` wasn't free'd at all when hooks are blocked too. This fix moves the message buffer into a local variable which is destroyed at the end of the function. Fixes #1286 and #1296 |
||
|---|---|---|
| .github | ||
| bridge/include | ||
| configs | ||
| core | ||
| editor | ||
| extensions | ||
| gamedata | ||
| licenses | ||
| loader | ||
| plugins | ||
| public | ||
| sourcepawn@381bc02811 | ||
| tools | ||
| translations | ||
| versionlib | ||
| .arcconfig | ||
| .gitattributes | ||
| .gitignore | ||
| .gitmodules | ||
| .travis.yml | ||
| AMBuildScript | ||
| changelog.txt | ||
| configure.py | ||
| product.version | ||
| pushbuild.txt | ||
| README.md | ||
SourceMod
General
- SourceMod website: Source Engine scripting and server administration
- Forum: Discussion forum including plugin/extension development
- General documentation: Miscellaneous information about SourceMod
- Stable builds: The latest stable SourceMod releases
- Dev builds: Builds of recent development versions
Development
- Issue tracker: Issues that require back and forth communication
- Building SourceMod: Instructions on how to build SourceMod itself using AMBuild
- SourcePawn scripting: SourcePawn examples and introduction to the language
- SourceMod plugin API: Online SourceMod plugin API reference generated from the include files
- SourceMod extension development: C++ examples and introduction to various extension interfaces
Contact
License
SourceMod is licensed under the GNU General Public License version 3. Special exceptions are outlined in the LICENSE.txt file inside of the licenses folder.