Skip to content

bugfix(network): Prevent use-after-free during HTTP request cleanup on shutdown #505

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
x64-dev merged 1 commit into from
May 7, 2026
Merged

bugfix(network): Prevent use-after-free during HTTP request cleanup on shutdown #505

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 17 additions & 1 deletion GeneralsMD/Code/GameEngine/Source/GameNetwork/GeneralsOnline/HTTP/HTTPManager.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -103,7 +103,12 @@ void HTTPManager::Shutdown()
HTTPRequest* pRequest = *it;
if (pRequest != nullptr && pRequest->EasyHandleMatches(pCurlHandle))
{
pRequest->Threaded_SetComplete(m->data.result);
// During shutdown, skip invoking the completion callback. The callback
// may reference objects (e.g. NGMP_OnlineServices_StatsInterface via
// captured 'this') that have already been or are being destroyed,
// leading to use-after-free memory corruption and crashes in unrelated
// destructors such as GameSpyMiscPreferences::~GameSpyMiscPreferences().
// HTTPRequest::~HTTPRequest() handles all necessary curl handle cleanup.
delete pRequest;
m_vecRequestsInFlight.erase(it);
break;
Expand All @@ -122,6 +127,17 @@ void HTTPManager::Shutdown()

NetworkLog(ELogVerbosity::LOG_RELEASE, "[HTTPManager] All in-flight requests completed");

// Delete any remaining in-flight requests without invoking their callbacks.
// These are requests that completed via curl but were not matched above, or
// requests that are still pending completion. Invoking callbacks here is unsafe
// as the objects they reference may already be destroyed.
for (HTTPRequest* pRequest : m_vecRequestsInFlight)
{
if (pRequest != nullptr)
{
delete pRequest;
}
}
m_vecRequestsInFlight.clear();

// Now safe to cleanup
Expand Down
Loading