Skip to content

Span UObject handling issue when buying tower powerup #12

@tustanivsky

Description

@tustanivsky
Potential bug: Local UObjects are captured by raw pointer in an async lambda and can be garbage collected before the lambda executes, causing a use-after-free.
  • Description: Local UObject instances, specifically USentryTransaction and USentrySpan, are created without being rooted or stored in a UPROPERTY. An asynchronous lambda captures raw pointers to these objects. When the function they are declared in returns, these objects become eligible for garbage collection. If the garbage collector runs before the async HTTP callback completes, the lambda will attempt to access freed memory when calling methods like CheckoutSpan->Finish() or CheckoutTransaction->Finish(), leading to a non-deterministic crash.

  • Suggested fix: To prevent the UObject instances from being garbage collected prematurely, either store them as UPROPERTY members of the game instance, or manually manage their lifetime using AddToRoot() when created and RemoveFromRoot() after the asynchronous operation completes.
    severity: 0.95, confidence: 0.98

Did we get this right? 👍 / 👎 to inform future reviews.

Originally posted by @seer-by-sentry[bot] in #10 (comment)

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions