From 62e80cd8948dafee15564b2fb262eeea1a7b7fc6 Mon Sep 17 00:00:00 2001 From: cdemirer <41021322+cdemirer@users.noreply.github.com> Date: Fri, 6 Feb 2026 03:10:15 +0300 Subject: [PATCH] Fix UAF in animation_tree.cpp (AHashMap realloc) (cherry picked from commit 164f117c16d59fa201956e0be5da45868e3cae46) --- scene/animation/animation_tree.cpp | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/scene/animation/animation_tree.cpp b/scene/animation/animation_tree.cpp index 53525034b6..deef9529a6 100644 --- a/scene/animation/animation_tree.cpp +++ b/scene/animation/animation_tree.cpp @@ -739,7 +739,8 @@ void AnimationTree::_animation_node_renamed(const ObjectID &p_oid, const String for (const PropertyInfo &E : properties) { if (E.name.begins_with(old_base)) { String new_name = E.name.replace_first(old_base, new_base); - property_map[new_name] = property_map[E.name]; + const Pair temp_copy = property_map[E.name]; + property_map[new_name] = temp_copy; property_map.erase(E.name); } }