Skip to content

Commit af93ae0

Browse files
authored
fix: use-after-free in Lua garbage collection of shared objects (#3553)
This fixes a critical use-after-free issue caused by the premature destruction of SharedObject instances managed via std::shared_ptr during Lua’s __gc finalization. Previously, the luaGarbageCollection function called reset() directly on the shared pointer, which could destroy the underlying object while it was still in use by C++ code — potentially leading to heap corruption and runtime crashes.
1 parent cb905e5 commit af93ae0

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

src/lua/functions/lua_functions_loader.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -810,7 +810,7 @@ void Lua::registerSharedClass(lua_State* L, const std::string &className, const
810810
int Lua::luaGarbageCollection(lua_State* L) {
811811
const auto objPtr = static_cast<std::shared_ptr<SharedObject>*>(lua_touserdata(L, 1));
812812
if (objPtr) {
813-
objPtr->reset();
813+
objPtr->~shared_ptr<SharedObject>();
814814
}
815815
return 0;
816816
}

0 commit comments

Comments
 (0)