ResourcePackManager: Fix crash when removing pack

Avoid accessing destroyed `QTableWidgetItem` by retrieving the desired
path from the item before it's destroyed.

In `ResourcePackManager::Remove` pointers to the selected items in `m_table_widget`
were saved in the local variable `items` before calling `Uninstall`.
`Uninstall` called `RepopulateTable` which called
`m_table_widget->clear()`, destroying the table's descendants.  Upon
returning to `Remove` `items` then pointed to some of those destroyed descendants, and
passing `items[0]` to `GetResourcePackIndex` resulted in a call to
`item->row()` which was a use-after-free.

Fixes https://bugs.dolphin-emu.org/issues/14095.
This commit is contained in:
Dentomologist
2026-07-09 21:11:43 -07:00
parent 6de526c684
commit 37dd6c287e

View File

@@ -3,6 +3,8 @@
#include "DolphinQt/ResourcePackManager.h"
#include <string>
#include <QDesktopServices>
#include <QDialogButtonBox>
#include <QGridLayout>
@@ -243,8 +245,10 @@ void ResourcePackManager::Remove()
if (box.exec() != QMessageBox::Yes)
return;
const std::string selected_pack_path =
ResourcePack::GetPacks()[GetResourcePackIndex(items[0])].GetPath();
Uninstall();
File::Delete(ResourcePack::GetPacks()[GetResourcePackIndex(items[0])].GetPath());
File::Delete(selected_pack_path);
RepopulateTable();
}