From 672ac25fd25903486d1a3467bd67a08a4dfcd67b Mon Sep 17 00:00:00 2001 From: Filipp Pavlov Date: Mon, 28 Sep 2026 10:07:17 +0000 Subject: [PATCH] Fix two sources of memory corruptions: - DX12 Tr2TextureAL m_readScratch could be deleted before the read operation finishes for asynchronous reads - Tr2BindingPoint may write to an invalid destination if the destination was destroyed after the binding was created --- trinity/Controllers/Tr2BindingPoint.cpp | 2 +- trinityal/dx12/Tr2TextureALDx12.cpp | 6 +++++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/trinity/Controllers/Tr2BindingPoint.cpp b/trinity/Controllers/Tr2BindingPoint.cpp index 413f1751b..defe70f64 100644 --- a/trinity/Controllers/Tr2BindingPoint.cpp +++ b/trinity/Controllers/Tr2BindingPoint.cpp @@ -304,7 +304,7 @@ void Tr2BindingPoint::Unlink() bool Tr2BindingPoint::IsValid() const { - return m_destination != nullptr; + return m_destination != nullptr && GetBoundObject() != nullptr; } void Tr2BindingPoint::SetValue( float value ) const diff --git a/trinityal/dx12/Tr2TextureALDx12.cpp b/trinityal/dx12/Tr2TextureALDx12.cpp index ac9dd816a..02e9d73ee 100644 --- a/trinityal/dx12/Tr2TextureALDx12.cpp +++ b/trinityal/dx12/Tr2TextureALDx12.cpp @@ -1080,7 +1080,11 @@ void Tr2TextureAL::Destroy() } m_writeScratches.clear(); m_mappedScratch = m_writeScratches.end(); - m_readScratch = nullptr; + if( m_readScratch ) + { + RELEASE_LATER( m_owner, m_readScratch ); + m_readScratch = nullptr; + } m_currentTextureIndex = 0; memset( &m_desc, 0, sizeof( m_desc ) ); m_msaa = Tr2MsaaDesc();