Skip to content

Fix undefined behavior: SAFE_DELETE_ARRAY on scalar new in CvNetwork - #1228

Open
acato wants to merge 1 commit into
We-the-People-civ4col-mod:developfrom
acato:fix/network-delete-array-ub
Open

Fix undefined behavior: SAFE_DELETE_ARRAY on scalar new in CvNetwork#1228
acato wants to merge 1 commit into
We-the-People-civ4col-mod:developfrom
acato:fix/network-delete-array-ub

Conversation

@acato

@acato acato commented Apr 3, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Changes SAFE_DELETE_ARRAY to SAFE_DELETE on lines 78 and 96 of CvNetwork.cpp
  • Network message objects are allocated with scalar new via createReceivedMessage() but were freed with SAFE_DELETE_ARRAY (delete[]), which is undefined behavior per C++ §5.3.5/2
  • This UB executes on every received network packet in multiplayer, risking heap corruption under different allocator/compiler configurations

Fixes #1226

Test plan

  • Verify multiplayer packet handling still works correctly (send/receive messages between players)
  • Confirm the fix compiles cleanly in Assert, Release, and FinalRelease targets

🤖 Generated with Claude Code

…for scalar new

CvNetwork message objects are allocated with scalar new via
createReceivedMessage() but freed with SAFE_DELETE_ARRAY (delete[]).
This is undefined behavior that runs on every received network packet
in multiplayer, risking heap corruption.

Fixes We-the-People-civ4col-mod#1226

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Security: SAFE_DELETE_ARRAY used on non-array allocation in CvNetwork — undefined behavior on every packet

1 participant