[Scummvm-git-logs] scummvm master -> 10e8bd72c7012d992e31bb6ea8e3f754a49591a3

[moralrecordings]

This automated email contains information about 1 new commit which have been
pushed to the 'scummvm' repo located at https://api.github.com/repos/scummvm/scummvm .

Summary:
10e8bd72c7 DIRECTOR: XOBJ: Fix use after free in QTVR


Commit: 10e8bd72c7012d992e31bb6ea8e3f754a49591a3
    https://github.com/scummvm/scummvm/commit/10e8bd72c7012d992e31bb6ea8e3f754a49591a3
Author: Scott Percival (code at moral.net.au)
Date: 2025-07-27T17:09:33+08:00

Commit Message:
DIRECTOR: XOBJ: Fix use after free in QTVR

Fixes transit mode in Star Trek TNG Interactive Technical Manual.

Changed paths:
    engines/director/lingo/xlibs/qtvr.cpp
    engines/director/lingo/xlibs/qtvr.h


diff --git a/engines/director/lingo/xlibs/qtvr.cpp b/engines/director/lingo/xlibs/qtvr.cpp
index 35e4fe1c9bd..c171eff4a82 100644
--- a/engines/director/lingo/xlibs/qtvr.cpp
+++ b/engines/director/lingo/xlibs/qtvr.cpp
@@ -99,6 +99,22 @@ QTVRXObject::QTVRXObject(ObjectType ObjectType) :Object<QTVRXObject>("QTVR") {
 	_objType = ObjectType;
 }
 
+QTVRXObject::~QTVRXObject() {
+	close();
+}
+
+void QTVRXObject::close() {
+	if (_video) {
+		_video->close();
+		delete _video;
+		_video = nullptr;
+	}
+	if (_widget) {
+		delete _widget;
+		_widget = nullptr;
+	}
+}
+
 void QTVR::open(ObjectType type, const Common::Path &path) {
 	if (type == kXObj) {
 		QTVRXObject::initMethods(xlibMethods);
@@ -125,11 +141,7 @@ void QTVR::m_dispose(int nargs) {
 	ARGNUMCHECK(0);
 
 	QTVRXObject *me = (QTVRXObject *)g_lingo->_state->me.u.obj;
-
-	if (me->_video) {
-		me->_video->close();
-		delete me->_video;
-	}
+	me->close();
 }
 
 void QTVR::m_getHPanAngle(int nargs) {
diff --git a/engines/director/lingo/xlibs/qtvr.h b/engines/director/lingo/xlibs/qtvr.h
index 903b3562f1b..d9f22bcfc9d 100644
--- a/engines/director/lingo/xlibs/qtvr.h
+++ b/engines/director/lingo/xlibs/qtvr.h
@@ -73,6 +73,9 @@ public:
 class QTVRXObject : public Object<QTVRXObject> {
 public:
 	QTVRXObject(ObjectType objType);
+	~QTVRXObject();
+
+	void close();
 
 	Common::Rect _rect;
 	Video::QuickTimeDecoder *_video = nullptr;