[Scummvm-git-logs] scummvm master -> 80aca9635f1baedb97f7e058cfc47a4c545d8d89

[bluegr]

This automated email contains information about 1 new commit which have been
pushed to the 'scummvm' repo located at https://api.github.com/repos/scummvm/scummvm .

Summary:
80aca9635f GUI: Prevent use-after-free in `_tooltip`


Commit: 80aca9635f1baedb97f7e058cfc47a4c545d8d89
    https://github.com/scummvm/scummvm/commit/80aca9635f1baedb97f7e058cfc47a4c545d8d89
Author: Greg Kennedy (kennedy.greg at gmail.com)
Date: 2026-08-23T02:40:10+03:00

Commit Message:
GUI: Prevent use-after-free in `_tooltip`

Modal dialog tooltips are created and then deleted, but
the _tooltip pointer is not reset to `nullptr` afterwards.

This can lead to use-after-free after deleting a tooltip.

Changed paths:
    gui/gui-manager.cpp


diff --git a/gui/gui-manager.cpp b/gui/gui-manager.cpp
index d7f4dd03205..d50f93dd60c 100644
--- a/gui/gui-manager.cpp
+++ b/gui/gui-manager.cpp
@@ -701,12 +701,12 @@ void GuiManager::runLoop() {
 						wdg->handleTooltipUpdate(_lastMousePosition.x + activeDialog->_x - wdg->getAbsX(), _lastMousePosition.y + activeDialog->_y - wdg->getAbsY());
 
 					if (wdg->hasTooltip()) {
-						Tooltip *tooltip = new Tooltip();
-						tooltip->setup(activeDialog, wdg, _lastMousePosition.x, _lastMousePosition.y);
-						_tooltip = tooltip;
+						_tooltip = new Tooltip();
+						_tooltip->setup(activeDialog, wdg, _lastMousePosition.x, _lastMousePosition.y);
 						_tooltip->runModal();
 						// _tooltip is reset in closeTopDialog
-						delete tooltip;
+						delete _tooltip;
+						_tooltip = nullptr;
 					}
 				}
 			}