src/Graphics/Common/Material.cpp:140-142; include/.../ObjectPtr.hpp:46-52;
src/Assets/ModelLoader.cpp:513-516, and setters at :479, :482, :485, :488, :491, :494
Material.cpp:140-142 wraps the incoming raw Texture* in an ObjectPtr<Texture>, which deletes on
destruction (ObjectPtr.hpp:46-52): i.e. it claims exclusive ownership.
ModelLoader.cpp:513-516 returns the same Texture* out of a per-model cache, and feeds it into exactly
those setters at :479-494.
So any glTF/FBX in which two materials share one albedo (or normal, or roughness) map hands two Material
objects ownership of a single Texture. Both delete it on teardown.
Shared texture maps across materials is the common case in real asset files, not an edge case. Runs on
every backend.
Severity: crash (double free).
Found by a full audit of the graphics layer. Assessed severity: crash: double free.
src/Graphics/Common/Material.cpp:140-142;include/.../ObjectPtr.hpp:46-52;src/Assets/ModelLoader.cpp:513-516, and setters at:479, :482, :485, :488, :491, :494Material.cpp:140-142wraps the incoming rawTexture*in anObjectPtr<Texture>, which deletes ondestruction (ObjectPtr.hpp:46-52): i.e. it claims exclusive ownership.
ModelLoader.cpp:513-516returns the sameTexture*out of a per-model cache, and feeds it into exactlythose setters at :479-494.
So any glTF/FBX in which two materials share one albedo (or normal, or roughness) map hands two
Materialobjects ownership of a single
Texture. Both delete it on teardown.Shared texture maps across materials is the common case in real asset files, not an edge case. Runs on
every backend.
Severity: crash (double free).
Found by a full audit of the graphics layer. Assessed severity: crash: double free.