Fix heap-use-after-free when ctrl-clicking controls in a container

timothyqiu · Spartan322 · commit f908f1908a5a · 2024-11-01T18:10:51.000-04:00
(cherry picked from commit 574b413)
diff --git a/editor/plugins/canvas_item_editor_plugin.cpp b/editor/plugins/canvas_item_editor_plugin.cpp
@@ -1462,10 +1462,12 @@ bool CanvasItemEditor::_gui_input_rotate(const Ref<InputEvent> &p_event) {
 				List<CanvasItem *> selection = _get_edited_canvas_items(false, true, &has_locked_items);
 
 				// Remove not movable nodes
-				for (CanvasItem *E : selection) {
-					if (!_is_node_movable(E, true)) {
+				for (List<CanvasItem *>::Element *E = selection.front(); E;) {
+					List<CanvasItem *>::Element *N = E->next();
+					if (!_is_node_movable(E->get(), true)) {
 						selection.erase(E);
 					}
+					E = N;
 				}
 
 				drag_selection = selection;

Original file line number	Diff line number	Diff line change
`@@ -1462,10 +1462,12 @@ bool CanvasItemEditor::_gui_input_rotate(const Ref<InputEvent> &p_event) {`
`1462`	`1462`	`List<CanvasItem *> selection = _get_edited_canvas_items(false, true, &has_locked_items);`
`1463`	`1463`
`1464`	`1464`	`// Remove not movable nodes`
`1465`		`- for (CanvasItem *E : selection) {`
`1466`		`- if (!_is_node_movable(E, true)) {`
	`1465`	`+ for (List<CanvasItem >::Element E = selection.front(); E;) {`
	`1466`	`+ List<CanvasItem >::Element N = E->next();`
	`1467`	`+ if (!_is_node_movable(E->get(), true)) {`
`1467`	`1468`	`selection.erase(E);`
`1468`	`1469`	`}`
	`1470`	`+ E = N;`
`1469`	`1471`	`}`
`1470`	`1472`
`1471`	`1473`	`drag_selection = selection;`