Skip to content

Fix heap-after-free due to document rescan#4499

Open
ppizarror wants to merge 1 commit into
texstudio-org:masterfrom
ppizarror:fix/getlistofdocs-uaf
Open

Fix heap-after-free due to document rescan#4499
ppizarror wants to merge 1 commit into
texstudio-org:masterfrom
ppizarror:fix/getlistofdocs-uaf

Conversation

@ppizarror

Copy link
Copy Markdown

Hi! First, thanks a lot for this fantastic project. I've been using it for several years.

I often struggle with crashes due to external updates to .tex files. While debugging, I got a use-after-free in LatexDocument::getListOfDocs(). Its result is cached in the project-shared lp->projectDocuments, but the cache was only invalidated in the two setMasterDocument paths. Every other mutation of the document set / master-child graph (deleteDocument, removeDocs, addDocument, addChild/removeChild) left stale.

So, for fixing it, I invalidated lp->projectDocuments on every graph mutation.
To confirm, added a unit test that confirms the exact crash pattern. Greetings!

@sunderme

sunderme commented Jun 8, 2026

Copy link
Copy Markdown
Member

Thanks. I will review later this week.

@sunderme

Copy link
Copy Markdown
Member

looks like a lp->projectDocuments.clear(); was added all over the place.
What action exactly leads to a crash ?

@ppizarror

Copy link
Copy Markdown
Author

Hi @sunderme. Often, when TexStudio is opened, and .tex files are rewritten or moved from VS Code (imagine I am using some agent). Or if I have some auto-generated .tex from a Python script, I run that script, regenerate .tex, and then TexStudio crashes.

I am running the latest version on macOS 26.5.1.
To spot the culprit, I just compiled and ran the debug version on my machine. You can see that, without the fix, the unit test I added just collapses to the exact crash I detected.
download

@sunderme

Copy link
Copy Markdown
Member

the file is open in txs while changed externally ?

@ppizarror

Copy link
Copy Markdown
Author

the file is open in txs while changed externally ?

exactly. that is a much better description 🤔

@sunderme

Copy link
Copy Markdown
Member

Well, I don't get a crash, but let's see.

@sunderme

sunderme commented Jun 10, 2026

Copy link
Copy Markdown
Member

I think, I would like to see a (simple) test case to recreate the issue.
Currently I do not see a crash (nor failure to invalidate the cache)

or you can check how it gets to "delete document" in your use case.

@ppizarror

Copy link
Copy Markdown
Author

Sure I will provide a simple test case by the end of the wee. Thanks!

@sunderme

Copy link
Copy Markdown
Member

I still would like to see a real test case.

@sunderme

Copy link
Copy Markdown
Member

can you check if txs still crashes on your end with latest changes ?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants