godotengine / godotengine/godot

Potential use after free on GDScript callable methods; methods do not capture self object when used as callables.

Open
#97,523 6 comments 0 reactions 0 assignees View on GitHub
bug confirmed topic:gdscript
Dominant language
C++
Stars
117k
Forks
26.8k
PR merge metrics
PR metrics pending

Description

### Tested versions

- Reproducible in 4.4.dev2, 4.3.stable, 4.2.2.stable, 4.1.4.stable, and 4.0.4.stable

### System information

Godot v4.3.stable (77dcf97d8) - NixOS #1-NixOS SMP PREEMPT_DYNAMIC Wed Sep 18 17:24:10 UTC 2024 - X11 - GLES3 (Compatibility)

### Issue description

Consider the following code:
```gdscript
extends Node

class Test:
func print_hi():
print("hi")

func other() -> Callable:
return Test.new().print_hi

func _ready():
other().call()
```
The expected result would be that it prints "hi" to the console; however, this instead pushes the following error:
> Attempt to call function 'null::print_hi (Callable)' on a null instance.

Calling `print_hi()` from within `other()` works fine, but the self object seems to be cleaned up after the callable is returned, resulting in calling it on a null instance. I believe the callable should capture its self object when bound like this.

### Steps to reproduce

1. Create a new function.
2. Create new object inside of that function and return a bound callable method from it.
3. Call the function from some other code, and call `.call()` or `.callv()` on the returned callable.
4. Observe the editor error, which says that the initial object is null.

### Minimal reproduction project (MRP)

[test.zip](https://github.com/user-attachments/files/17158845/test.zip)

Contributor guide

Open the contributing guide

Research direction

Start with the supplied GDScript reproduction and test.zip, focusing on a method callable returned from a locally created object and then invoked with call() or callv(). Done means the callable retains its self object, prints "hi", and no longer reports that the instance is null.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, godot
Domain
game-dev
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.