From e5dbeaf9d629180360f75b9306fa311afce765df Mon Sep 17 00:00:00 2001
From: "seer-by-sentry[bot]"
 <157164994+seer-by-sentry[bot]@users.noreply.github.com>
Date: Sat, 25 Oct 2025 10:42:47 +0000
Subject: [PATCH] DX8Renderer: Prevent use-after-free in
 DX8TextureCategoryClass destructor

---
 .../Libraries/Source/WWVegas/WW3D2/dx8renderer.cpp   | 12 ++++++++++--
 .../Libraries/Source/WWVegas/WW3D2/dx8renderer.cpp   | 12 ++++++++++--
 2 files changed, 20 insertions(+), 4 deletions(-)

diff --git a/Generals/Code/Libraries/Source/WWVegas/WW3D2/dx8renderer.cpp b/Generals/Code/Libraries/Source/WWVegas/WW3D2/dx8renderer.cpp
index b088e3361f1..4748fec0c0b 100644
--- a/Generals/Code/Libraries/Source/WWVegas/WW3D2/dx8renderer.cpp
+++ b/Generals/Code/Libraries/Source/WWVegas/WW3D2/dx8renderer.cpp
@@ -210,9 +210,17 @@ DX8TextureCategoryClass::DX8TextureCategoryClass(
 
 DX8TextureCategoryClass::~DX8TextureCategoryClass()
 {
+	// Clear texture_category pointers from all polygon renderers to prevent use-after-free
+	// when they are deleted during Unregister_Mesh_Type
+	DX8PolygonRendererClass* p_renderer = PolygonRendererList.Get_Head();
+	while (p_renderer) {
+		p_renderer->Set_Texture_Category(NULL);
+		p_renderer = PolygonRendererList.Get_Next(p_renderer);
+	}
+
 	// Unregistering the mesh where polygon renderers are connected to kills all polygon renderers
-	while (DX8PolygonRendererClass* p_renderer=PolygonRendererList.Get_Head()) {
-		TheDX8MeshRenderer.Unregister_Mesh_Type(p_renderer->Get_Mesh_Model_Class());
+	while (DX8PolygonRendererClass* renderer=PolygonRendererList.Get_Head()) {
+		TheDX8MeshRenderer.Unregister_Mesh_Type(renderer->Get_Mesh_Model_Class());
 	}
 	for (int a=0;a<MAX_TEXTURE_STAGES;++a) {
 		REF_PTR_RELEASE(textures[a]);
diff --git a/GeneralsMD/Code/Libraries/Source/WWVegas/WW3D2/dx8renderer.cpp b/GeneralsMD/Code/Libraries/Source/WWVegas/WW3D2/dx8renderer.cpp
index ae773e36076..fbf8c26116e 100644
--- a/GeneralsMD/Code/Libraries/Source/WWVegas/WW3D2/dx8renderer.cpp
+++ b/GeneralsMD/Code/Libraries/Source/WWVegas/WW3D2/dx8renderer.cpp
@@ -212,9 +212,17 @@ DX8TextureCategoryClass::DX8TextureCategoryClass(
 
 DX8TextureCategoryClass::~DX8TextureCategoryClass()
 {
+	// Clear texture_category pointers from all polygon renderers to prevent use-after-free
+	// when they are deleted during Unregister_Mesh_Type
+	DX8PolygonRendererClass* p_renderer = PolygonRendererList.Get_Head();
+	while (p_renderer) {
+		p_renderer->Set_Texture_Category(NULL);
+		p_renderer = PolygonRendererList.Get_Next(p_renderer);
+	}
+
 	// Unregistering the mesh where polygon renderers are connected to kills all polygon renderers
-	while (DX8PolygonRendererClass* p_renderer=PolygonRendererList.Get_Head()) {
-		TheDX8MeshRenderer.Unregister_Mesh_Type(p_renderer->Get_Mesh_Model_Class());
+	while (DX8PolygonRendererClass* renderer=PolygonRendererList.Get_Head()) {
+		TheDX8MeshRenderer.Unregister_Mesh_Type(renderer->Get_Mesh_Model_Class());
 	}
 	for (int a=0;a<MeshMatDescClass::MAX_TEX_STAGES;++a)
 	{