From f21f8d6ad21e9e372b5bd8197d37d28cdb818ee3 Mon Sep 17 00:00:00 2001
From: Anders Wang Kristensen <anderswk@ioi.dk>
Date: Wed, 10 Sep 2025 12:56:47 +0200
Subject: [PATCH 1/2] Fix crash due to freeing elements of m_serialDequeue
 twice.

In Profiler::DequeueSerial if AppendData fails part way through m_serialDequeue then the elements could be freed again in Profiler::ClearSerial, which leads to memory corruption in rpmalloc.
---
 public/client/TracyProfiler.cpp | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/public/client/TracyProfiler.cpp b/public/client/TracyProfiler.cpp
index 6f242de6..452ec446 100644
--- a/public/client/TracyProfiler.cpp
+++ b/public/client/TracyProfiler.cpp
@@ -2846,6 +2846,8 @@ Profiler::DequeueStatus Profiler::DequeueSerial()
         }
     }
 
+    DequeueStatus dequeueStatus = DequeueStatus::QueueEmpty;
+
     const auto sz = m_serialDequeue.size();
     if( sz > 0 )
     {
@@ -3145,7 +3147,10 @@ Profiler::DequeueStatus Profiler::DequeueSerial()
                 }
             }
 #endif
-            if( !AppendData( item, QueueDataSize[idx] ) ) return DequeueStatus::ConnectionLost;
+            if(dequeueStatus != DequeueStatus::ConnectionLost && !AppendData( item, QueueDataSize[idx] ) )
+            {
+                dequeueStatus = DequeueStatus::ConnectionLost;
+            }
             item++;
         }
         m_refTimeSerial = refSerial;
@@ -3155,11 +3160,7 @@ Profiler::DequeueStatus Profiler::DequeueSerial()
 #endif
         m_serialDequeue.clear();
     }
-    else
-    {
-        return DequeueStatus::QueueEmpty;
-    }
-    return DequeueStatus::DataDequeued;
+    return dequeueStatus;
 }
 
 Profiler::ThreadCtxStatus Profiler::ThreadCtxCheck( uint32_t threadId )

From 355a11f47f5bc53364dfbbb25121872680aa1aa0 Mon Sep 17 00:00:00 2001
From: Anders Wang Kristensen <anderswk@ioi.dk>
Date: Wed, 10 Sep 2025 14:43:28 +0200
Subject: [PATCH 2/2] Missing initialization of dequeueStatus

---
 public/client/TracyProfiler.cpp | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/public/client/TracyProfiler.cpp b/public/client/TracyProfiler.cpp
index 452ec446..b507c104 100644
--- a/public/client/TracyProfiler.cpp
+++ b/public/client/TracyProfiler.cpp
@@ -2851,6 +2851,8 @@ Profiler::DequeueStatus Profiler::DequeueSerial()
     const auto sz = m_serialDequeue.size();
     if( sz > 0 )
     {
+         dequeueStatus = DequeueStatus::DataDequeued;
+
         InitRpmalloc();
         int64_t refSerial = m_refTimeSerial;
         int64_t refGpu = m_refTimeGpu;