commit 3e0cd5dc0cd0d5b6788100a2fbc1cdd4ce014b35
Author:     Fabian Greffrath <fabian@greffrath.com>
AuthorDate: Thu Jan 22 13:44:48 2026 +0100
Commit:     GitHub <noreply@github.com>
CommitDate: Thu Jan 22 13:44:48 2026 +0100

    Fix use-after-free in DEH_LoadFile()/DEH_LoadLump() (#1783)

    * Fix use-after-free in DEH_LoadFile()/DEH_LoadLump()

    DEH_CloseFile(context) already calls Z_Free(context), so the later
    call to DEH_HadError(context) gets passed an already freed pointer.

    No problem for the zone allocator, but a use-after-free when the
    native allocator is used.

    * Still close the context before erroring out
---
 src/deh_main.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/src/deh_main.c b/src/deh_main.c
index 45e35516..3ef8a25c 100644
--- a/src/deh_main.c
+++ b/src/deh_main.c
@@ -371,6 +371,7 @@ static void DEH_ParseContext(deh_context_t *context)
 int DEH_LoadFile(const char *filename)
 {
     deh_context_t *context;
+    boolean had_error;

     if (!deh_initialized)
     {
@@ -396,9 +397,11 @@ int DEH_LoadFile(const char *filename)

     DEH_ParseContext(context);

+    had_error = DEH_HadError(context);
+
     DEH_CloseFile(context);

-    if (DEH_HadError(context))
+    if (had_error)
     {
         I_Error("Error parsing dehacked file");
     }
@@ -434,6 +437,7 @@ void DEH_AutoLoadPatches(const char *path)
 int DEH_LoadLump(int lumpnum, boolean allow_long, boolean allow_error)
 {
     deh_context_t *context;
+    boolean had_error;

     if (!deh_initialized)
     {
@@ -455,11 +459,13 @@ int DEH_LoadLump(int lumpnum, boolean allow_long, boolean allow_error)

     DEH_ParseContext(context);

+    had_error = DEH_HadError(context);
+
     DEH_CloseFile(context);

     // If there was an error while parsing, abort with an error, but allow
     // errors to just be ignored if allow_error=true.
-    if (!allow_error && DEH_HadError(context))
+    if (!allow_error && had_error)
     {
         I_Error("Error parsing dehacked lump");
     }