Skip to content

Fix segfault when switching perfstats screen before sampling is done

Hanicef requested to merge Hanicef/SRB2:fix-switch-perfstats-segfault into next

If ps_samplesize is set and a switch to a different perfstats page is made before the sampling is done, the game would segfault. This is caused due to use-after-free in the case of sampling, because in that case, the function calls PS_UpdateMetricHistory instead of PS_UpdateFrameStats, where the metric history is allocated and preserved until sufficient sampling is done. Problem is that for page 3, 4, and 5, it didn't set the user pointer on the history object, so switching before sampling is done would cause the pointer to become dangling, triggering a segfault.

This can be easily triggered by setting ps_samplesize to a really high number (which it already is now by default) and just switching between perfstats 3 and perfstats 5.

Merge request reports

Loading