[Scummvm-git-logs] scummvm master -> 446908f458bd9307b4e0162eb12a8fd01c41d03a

[sev-]

This automated email contains information about 1 new commit which have been
pushed to the 'scummvm' repo located at https://github.com/scummvm/scummvm .

Summary:
446908f458 GRAPHICS: MACGUI: Fix crash on reshuffling text after table in Markdown


Commit: 446908f458bd9307b4e0162eb12a8fd01c41d03a
    https://github.com/scummvm/scummvm/commit/446908f458bd9307b4e0162eb12a8fd01c41d03a
Author: Eugene Sandulenko (sev at scummvm.org)
Date: 2023-11-23T00:13:33+01:00

Commit Message:
GRAPHICS: MACGUI: Fix crash on reshuffling text after table in Markdown

Array::insert_at() is calling destructor for old data, whuch was freeing
the _table pointer that we are copying to new element which led to
use-after-free.

This moves MacTextLine cleanup to MacTextCanvas.

Changed paths:
    graphics/macgui/mactext-canvas.cpp
    graphics/macgui/mactext-canvas.h


diff --git a/graphics/macgui/mactext-canvas.cpp b/graphics/macgui/mactext-canvas.cpp
index f41bb98e2e9..1756c7946d1 100644
--- a/graphics/macgui/mactext-canvas.cpp
+++ b/graphics/macgui/mactext-canvas.cpp
@@ -36,6 +36,16 @@ namespace Graphics {
 #define DN(...)  ;
 #endif
 
+MacTextCanvas::~MacTextCanvas() {
+	delete _surface;
+	delete _shadowSurface;
+
+	for (auto &t : _text) {
+		delete t.table;
+		delete t.tableSurface;
+	}
+}
+
 // Adds the given string to the end of the last line/chunk
 // while observing the _canvas._maxWidth and keeping this chunk's
 // formatting
diff --git a/graphics/macgui/mactext-canvas.h b/graphics/macgui/mactext-canvas.h
index 9b0ceea7a8b..311a2aa7aed 100644
--- a/graphics/macgui/mactext-canvas.h
+++ b/graphics/macgui/mactext-canvas.h
@@ -124,10 +124,7 @@ public:
 	MacFontRun _defaultFormatting;
 
 public:
-	~MacTextCanvas() {
-		delete _surface;
-		delete _shadowSurface;
-	}
+	~MacTextCanvas();
 
 	void recalcDims();
 	void reallocSurface();
@@ -205,11 +202,6 @@ struct MacTextLine {
 	 * @note If requested column is too big, returns last character in the line
 	 */
 	uint getChunkNum(int *col);
-
-	~MacTextLine() {
-		delete table;
-		delete tableSurface;
-	}
 };
 
 } // End of namespace Graphics