![]() `menu_animation_update` enumerates `menu_animation.list` to process each `tween`. It was observed that some tweens execute a callback that pushes more animations via `menu_animation_push`. During the push, if the tween `list` does not have enough space, a `realloc` occurs, potentially invalidating the existing list. The remaining pointer access in menu_animation_update is therefore invalid. Best case is the memory is unused and thus does not affect the program. Worst case is memory corruption. |
||
---|---|---|
.. | ||
dynarray.h |