From 37dd6c287eac591b4d97cbfd90d16c2093b68020 Mon Sep 17 00:00:00 2001 From: Dentomologist Date: Thu, 9 Jul 2026 21:11:43 -0700 Subject: [PATCH] ResourcePackManager: Fix crash when removing pack Avoid accessing destroyed `QTableWidgetItem` by retrieving the desired path from the item before it's destroyed. In `ResourcePackManager::Remove` pointers to the selected items in `m_table_widget` were saved in the local variable `items` before calling `Uninstall`. `Uninstall` called `RepopulateTable` which called `m_table_widget->clear()`, destroying the table's descendants. Upon returning to `Remove` `items` then pointed to some of those destroyed descendants, and passing `items[0]` to `GetResourcePackIndex` resulted in a call to `item->row()` which was a use-after-free. Fixes https://bugs.dolphin-emu.org/issues/14095. --- Source/Core/DolphinQt/ResourcePackManager.cpp | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/Source/Core/DolphinQt/ResourcePackManager.cpp b/Source/Core/DolphinQt/ResourcePackManager.cpp index 90739da45f..221a752f57 100644 --- a/Source/Core/DolphinQt/ResourcePackManager.cpp +++ b/Source/Core/DolphinQt/ResourcePackManager.cpp @@ -3,6 +3,8 @@ #include "DolphinQt/ResourcePackManager.h" +#include + #include #include #include @@ -243,8 +245,10 @@ void ResourcePackManager::Remove() if (box.exec() != QMessageBox::Yes) return; + const std::string selected_pack_path = + ResourcePack::GetPacks()[GetResourcePackIndex(items[0])].GetPath(); Uninstall(); - File::Delete(ResourcePack::GetPacks()[GetResourcePackIndex(items[0])].GetPath()); + File::Delete(selected_pack_path); RepopulateTable(); }