From 151d58a5bebb6d0fa46945891bcf7d30b4a7bb7e Mon Sep 17 00:00:00 2001 From: Aly Cerruti Date: Fri, 8 Aug 2025 18:10:29 -0700 Subject: [PATCH 1/2] fix: double free of resizing handler's userdata on Windows Using WM_NCDESTROY instead of WM_DESTROY is more correct for freeing userdata, as windows can receive multiple WM_DESTROY events if they're parented. --- crates/tauri-runtime-wry/src/undecorated_resizing.rs | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/crates/tauri-runtime-wry/src/undecorated_resizing.rs b/crates/tauri-runtime-wry/src/undecorated_resizing.rs index 62a1d1439374..36f54f69a6d0 100644 --- a/crates/tauri-runtime-wry/src/undecorated_resizing.rs +++ b/crates/tauri-runtime-wry/src/undecorated_resizing.rs @@ -249,7 +249,7 @@ mod windows { data.has_undecorated_shadows = wparam.0 != 0; } - WM_DESTROY => { + WM_NCDESTROY => { let data = data as *mut UndecoratedResizingData; drop(Box::from_raw(data)); } @@ -388,7 +388,7 @@ mod windows { data.has_undecorated_shadows = wparam.0 != 0; } - WM_DESTROY => { + WM_NCDESTROY => { let data = GetWindowLongPtrW(child, GWLP_USERDATA); let data = data as *mut UndecoratedResizingData; drop(Box::from_raw(data)); From 5e1d54fd11ca943d71493a3dad2e7b9ebe588f17 Mon Sep 17 00:00:00 2001 From: Aly Cerruti Date: Fri, 8 Aug 2025 20:38:15 -0700 Subject: [PATCH 2/2] chore: add change entry for resizing handler double-free fix --- .changes/fix-resizing-double-free.md | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .changes/fix-resizing-double-free.md diff --git a/.changes/fix-resizing-double-free.md b/.changes/fix-resizing-double-free.md new file mode 100644 index 000000000000..04c2fbafb413 --- /dev/null +++ b/.changes/fix-resizing-double-free.md @@ -0,0 +1,5 @@ +--- +"tauri-runtime-wry": "patch:bug" +--- + +Use WM_NCDESTROY instead of WM_DESTROY to free window userdata, fixing a double-free occurring in the Windows resizing handler for undecorated windows which caused STATUS_HEAP_CORRUPTION