-
-
Notifications
You must be signed in to change notification settings - Fork 2
Description
Potential bug: Local UObjects are captured by raw pointer in an async lambda and can be garbage collected before the lambda executes, causing a use-after-free.
-
Description: Local
UObjectinstances, specificallyUSentryTransactionandUSentrySpan, are created without being rooted or stored in aUPROPERTY. An asynchronous lambda captures raw pointers to these objects. When the function they are declared in returns, these objects become eligible for garbage collection. If the garbage collector runs before the async HTTP callback completes, the lambda will attempt to access freed memory when calling methods likeCheckoutSpan->Finish()orCheckoutTransaction->Finish(), leading to a non-deterministic crash. -
Suggested fix: To prevent the
UObjectinstances from being garbage collected prematurely, either store them asUPROPERTYmembers of the game instance, or manually manage their lifetime usingAddToRoot()when created andRemoveFromRoot()after the asynchronous operation completes.
severity: 0.95, confidence: 0.98
Did we get this right? π / π to inform future reviews.
Originally posted by @seer-by-sentry[bot] in #10 (comment)