From 970f8691dd5e54bd7667438efe5f2cd8e261d199 Mon Sep 17 00:00:00 2001 From: Oliver Chang Date: Wed, 18 Feb 2026 05:16:53 +1100 Subject: [PATCH] FBXExporter: Fix stack-use-after-scope in WriteObjects (#6472) The FBX exporter was unconditionally dereferencing a map iterator (`tp_elem`) even when the key was not found (i.e., `tp_elem == tpath_by_image.end()`). This resulted in a stack-use-after-scope error when accessing `tp_elem->second` to populate "FileName" and "RelativeFilename" nodes, as dereferencing the end iterator of the map accessed invalid stack memory (the map's sentinel). The code already correctly initialized a local `tfile_path` variable based on whether the iterator was valid. This patch updates the `AddChild` calls to use `tfile_path` instead of dereferencing the potentially invalid iterator. Fixes: https://issues.oss-fuzz.com/issues/465494996 Co-authored-by: CodeMender Co-authored-by: Kim Kulling --- code/AssetLib/FBX/FBXExporter.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/code/AssetLib/FBX/FBXExporter.cpp b/code/AssetLib/FBX/FBXExporter.cpp index edb78a764..90ce22a75 100644 --- a/code/AssetLib/FBX/FBXExporter.cpp +++ b/code/AssetLib/FBX/FBXExporter.cpp @@ -1766,8 +1766,8 @@ void FBXExporter::WriteObjects () { // can't easily determine which texture path will be correct, // so just store what we have in every field. // these being incorrect is a common problem with FBX anyway. - tnode.AddChild("FileName", tp_elem->second); - tnode.AddChild("RelativeFilename", tp_elem->second); + tnode.AddChild("FileName", tfile_path); + tnode.AddChild("RelativeFilename", tfile_path); tnode.AddChild("ModelUVTranslation", double(0.0), double(0.0)); tnode.AddChild("ModelUVScaling", double(1.0), double(1.0)); tnode.AddChild("Texture_Alpha_Source", "None");