godotengine / godotengine/godot
Potential use after free on GDScript callable methods; methods do not capture self object when used as callables.
- Dominant language
- C++
- Stars
- 117k
- Forks
- 26.8k
- PR merge metrics
- PR metrics pending
Description
### Tested versions
- Reproducible in 4.4.dev2, 4.3.stable, 4.2.2.stable, 4.1.4.stable, and 4.0.4.stable
### System information
Godot v4.3.stable (77dcf97d8) - NixOS #1-NixOS SMP PREEMPT_DYNAMIC Wed Sep 18 17:24:10 UTC 2024 - X11 - GLES3 (Compatibility)
### Issue description
Consider the following code:
```gdscript
extends Node
class Test:
func print_hi():
print("hi")
func other() -> Callable:
return Test.new().print_hi
func _ready():
other().call()
```
The expected result would be that it prints "hi" to the console; however, this instead pushes the following error:
> Attempt to call function 'null::print_hi (Callable)' on a null instance.
Calling `print_hi()` from within `other()` works fine, but the self object seems to be cleaned up after the callable is returned, resulting in calling it on a null instance. I believe the callable should capture its self object when bound like this.
### Steps to reproduce
1. Create a new function.
2. Create new object inside of that function and return a bound callable method from it.
3. Call the function from some other code, and call `.call()` or `.callv()` on the returned callable.
4. Observe the editor error, which says that the initial object is null.
### Minimal reproduction project (MRP)
[test.zip](https://github.com/user-attachments/files/17158845/test.zip)
Contributor guide
Research direction
Start with the supplied GDScript reproduction and test.zip, focusing on a method callable returned from a locally created object and then invoked with call() or callv(). Done means the callable retains its self object, prints "hi", and no longer reports that the instance is null.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp, godot
- Domain
- game-dev
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100