From 9d42b86f1b9b6f46de5e4c129a387771bdcbcbf0 Mon Sep 17 00:00:00 2001 From: cperthuisoc <50219093+cperthuisoc@users.noreply.github.com> Date: Fri, 18 Jun 2021 21:53:23 -0700 Subject: [PATCH] Fix mismatched malloc and delete (#440) * Fixes crash in ktxTexture2_TranscodeBasis due to mismatched malloc and delete The crash happened inside the delete, 100% with MSVC, with and without optimizations. The repro steps were simply to call the ktxTexture2_TranscodeBasis function with a basis universal ktx2 file: ``` ktxTexture* texture; KTX_error_code result = ktxTexture_CreateFromMemory( (const uint8_t*)data, size, KTX_TEXTURE_CREATE_LOAD_IMAGE_DATA_BIT, &texture); if (result != KTX_SUCCESS) { return false; } if (ktxTexture_NeedsTranscoding(texture)) { result = ktxTexture2_TranscodeBasis( (ktxTexture2*)texture, ktx_transcode_fmt_e::KTX_TTF_ASTC_4x4_RGBA, 0); if (result != KTX_SUCCESS) { return false; } } ``` I didn't find any other location using delete instead of free, or new instead of malloc for this member. The other locations are all using malloc and free. --- lib/basis_transcode.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/basis_transcode.cpp b/lib/basis_transcode.cpp index a095ee723d..a11747169e 100644 --- a/lib/basis_transcode.cpp +++ b/lib/basis_transcode.cpp @@ -358,10 +358,10 @@ ktxTexture2_transcodeUastc(ktxTexture2* This, memcpy(priv._levelIndex, protoPriv._levelIndex, This->numLevels * sizeof(ktxLevelIndexEntry)); // Move the DFD and data from the prototype to This. - delete This->pDfd; + free(This->pDfd); This->pDfd = prototype->pDfd; prototype->pDfd = 0; - delete This->pData; + free(This->pData); This->pData = prototype->pData; This->dataSize = prototype->dataSize; prototype->pData = 0;