From a0023d84cde31b7e6df2074d6223e4cac54199de Mon Sep 17 00:00:00 2001 From: baldurk Date: Thu, 19 Dec 2019 17:46:33 +0000 Subject: [PATCH] Fix use-after-free with dangling reference while splitting subresources --- renderdoc/driver/vulkan/vk_manager.cpp | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/renderdoc/driver/vulkan/vk_manager.cpp b/renderdoc/driver/vulkan/vk_manager.cpp index a69749ae9..0bd2a6f37 100644 --- a/renderdoc/driver/vulkan/vk_manager.cpp +++ b/renderdoc/driver/vulkan/vk_manager.cpp @@ -125,10 +125,12 @@ void VulkanResourceManager::RecordSingleBarrier( state.second.subresourceRange.levelCount = 1; state.second.subresourceRange.layerCount = 1; + rdcpair existing = state; + // insert new copies of the current state to expand out the subresources. Only insert // count-1 as we want count entries total - one per subresource for(size_t sub = 0; sub < count - 1; sub++) - dststates.insert(i, state); + dststates.insert(i, existing); for(size_t sub = 0; sub < count; sub++) { @@ -736,10 +738,13 @@ void VulkanResourceManager::ApplyBarriers(uint32_t queueFamilyIndex, state.subresourceRange.levelCount = 1; state.subresourceRange.layerCount = 1; + // copy now, state will no longer be valid after inserting below + ImageRegionState existing = state; + // insert new copies of the current state to expand out the subresources. Only insert // count-1 as we want count entries total - one per subresource for(size_t sub = 0; sub < count - 1; sub++) - stit->second.subresourceStates.insert(i, state); + stit->second.subresourceStates.insert(i, existing); for(size_t sub = 0; sub < count; sub++) {